27529c647d59f380396d2ddaad95e7b9d36aa672ad8d3c15381058d666984208

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c7f823dc8618dfe5401120937773d60N.exe
Size

468KB
MD5

3c7f823dc8618dfe5401120937773d60
SHA1

dcf8b01ee5bfe8326e2f9a16f39ee73f8ff434de
SHA256

27529c647d59f380396d2ddaad95e7b9d36aa672ad8d3c15381058d666984208
SHA512

ce0af2039dd0831fedec996faefe8719730f5e715880c67010f6dcda210596c6f90e9c2640e02175db7a9cbdfc84959a8fe30510a0505b6ae2864cc21f584ea3
SSDEEP

3072:1bAIogIdId5jtbKdPOtjcc8/52C4J3pnymHekVqhRvb8QcQ6XYElW:1bbowbjtcPOjccBZUhRvI1pXY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2556	Unicorn-34643.exe
2960	Unicorn-7271.exe
264	Unicorn-59233.exe
2948	Unicorn-30220.exe
2884	Unicorn-24281.exe
2644	Unicorn-30412.exe
2648	Unicorn-10546.exe
2672	Unicorn-2249.exe
1288	Unicorn-18393.exe
1684	Unicorn-22992.exe
1988	Unicorn-59815.exe
2836	Unicorn-53950.exe
2008	Unicorn-60080.exe
3016	Unicorn-20863.exe
2716	Unicorn-60929.exe
2360	Unicorn-28126.exe
1136	Unicorn-27716.exe
1224	Unicorn-16986.exe
1712	Unicorn-63425.exe
1660	Unicorn-17754.exe
2364	Unicorn-17754.exe
236	Unicorn-8631.exe
1552	Unicorn-17754.exe
2232	Unicorn-49476.exe
2276	Unicorn-63019.exe
2456	Unicorn-9398.exe
772	Unicorn-9663.exe
1156	Unicorn-3533.exe
1724	Unicorn-9663.exe
2280	Unicorn-47183.exe
2500	Unicorn-63638.exe
892	Unicorn-17967.exe
2912	Unicorn-57363.exe
2896	Unicorn-57363.exe
2752	Unicorn-63493.exe
2876	Unicorn-44002.exe
2052	Unicorn-24951.exe
1092	Unicorn-12502.exe
1420	Unicorn-62580.exe
1332	Unicorn-54226.exe
1992	Unicorn-63156.exe
2972	Unicorn-13078.exe
1416	Unicorn-19811.exe
2680	Unicorn-211.exe
2408	Unicorn-50253.exe
1148	Unicorn-34986.exe
1936	Unicorn-28855.exe
708	Unicorn-50445.exe
3068	Unicorn-50445.exe
996	Unicorn-50445.exe
1956	Unicorn-43344.exe
836	Unicorn-48945.exe
1376	Unicorn-19283.exe
1564	Unicorn-19017.exe
752	Unicorn-24217.exe
880	Unicorn-55550.exe
1760	Unicorn-40470.exe
2204	Unicorn-29366.exe
2808	Unicorn-39463.exe
2748	Unicorn-10974.exe
2760	Unicorn-61846.exe
2976	Unicorn-61581.exe
2696	Unicorn-53398.exe
2020	Unicorn-44934.exe

Loads dropped DLL 64 IoCs

pid	Process
2512	3c7f823dc8618dfe5401120937773d60N.exe
2512	3c7f823dc8618dfe5401120937773d60N.exe
2556	Unicorn-34643.exe
2512	3c7f823dc8618dfe5401120937773d60N.exe
2556	Unicorn-34643.exe
2512	3c7f823dc8618dfe5401120937773d60N.exe
2960	Unicorn-7271.exe
2960	Unicorn-7271.exe
2512	3c7f823dc8618dfe5401120937773d60N.exe
2512	3c7f823dc8618dfe5401120937773d60N.exe
2556	Unicorn-34643.exe
264	Unicorn-59233.exe
2556	Unicorn-34643.exe
264	Unicorn-59233.exe
2948	Unicorn-30220.exe
2948	Unicorn-30220.exe
2960	Unicorn-7271.exe
2960	Unicorn-7271.exe
2884	Unicorn-24281.exe
2884	Unicorn-24281.exe
2512	3c7f823dc8618dfe5401120937773d60N.exe
2512	3c7f823dc8618dfe5401120937773d60N.exe
2556	Unicorn-34643.exe
2556	Unicorn-34643.exe
264	Unicorn-59233.exe
2648	Unicorn-10546.exe
264	Unicorn-59233.exe
2648	Unicorn-10546.exe
2672	Unicorn-2249.exe
2672	Unicorn-2249.exe
2948	Unicorn-30220.exe
2948	Unicorn-30220.exe
2644	Unicorn-30412.exe
2644	Unicorn-30412.exe
2008	Unicorn-60080.exe
2008	Unicorn-60080.exe
2648	Unicorn-10546.exe
2648	Unicorn-10546.exe
1988	Unicorn-59815.exe
1684	Unicorn-22992.exe
3016	Unicorn-20863.exe
1988	Unicorn-59815.exe
3016	Unicorn-20863.exe
1684	Unicorn-22992.exe
2512	3c7f823dc8618dfe5401120937773d60N.exe
2512	3c7f823dc8618dfe5401120937773d60N.exe
2884	Unicorn-24281.exe
264	Unicorn-59233.exe
2884	Unicorn-24281.exe
264	Unicorn-59233.exe
2960	Unicorn-7271.exe
2556	Unicorn-34643.exe
2960	Unicorn-7271.exe
2556	Unicorn-34643.exe
1288	Unicorn-18393.exe
2836	Unicorn-53950.exe
1288	Unicorn-18393.exe
2836	Unicorn-53950.exe
2716	Unicorn-60929.exe
2716	Unicorn-60929.exe
2672	Unicorn-2249.exe
2360	Unicorn-28126.exe
2672	Unicorn-2249.exe
2360	Unicorn-28126.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
2988	1712	WerFault.exe	49
7144	5900	WerFault.exe	507
7148	5504	WerFault.exe	495
7164	5428	WerFault.exe	501
6492	5684	WerFault.exe	498
6764	6196	WerFault.exe	513
6776	5748	WerFault.exe	506
6900	5448	WerFault.exe	502
6692	7128	WerFault.exe	569

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43320.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2512	3c7f823dc8618dfe5401120937773d60N.exe
2556	Unicorn-34643.exe
2960	Unicorn-7271.exe
264	Unicorn-59233.exe
2948	Unicorn-30220.exe
2644	Unicorn-30412.exe
2884	Unicorn-24281.exe
2648	Unicorn-10546.exe
2672	Unicorn-2249.exe
1684	Unicorn-22992.exe
1288	Unicorn-18393.exe
1988	Unicorn-59815.exe
2008	Unicorn-60080.exe
2836	Unicorn-53950.exe
3016	Unicorn-20863.exe
2716	Unicorn-60929.exe
2360	Unicorn-28126.exe
1136	Unicorn-27716.exe
1224	Unicorn-16986.exe
236	Unicorn-8631.exe
1660	Unicorn-17754.exe
2276	Unicorn-63019.exe
2456	Unicorn-9398.exe
1712	Unicorn-63425.exe
772	Unicorn-9663.exe
2232	Unicorn-49476.exe
1724	Unicorn-9663.exe
1156	Unicorn-3533.exe
1552	Unicorn-17754.exe
2364	Unicorn-17754.exe
2280	Unicorn-47183.exe
2896	Unicorn-57363.exe
2500	Unicorn-63638.exe
892	Unicorn-17967.exe
2752	Unicorn-63493.exe
2912	Unicorn-57363.exe
2876	Unicorn-44002.exe
2052	Unicorn-24951.exe
1092	Unicorn-12502.exe
1992	Unicorn-63156.exe
1332	Unicorn-54226.exe
2972	Unicorn-13078.exe
1416	Unicorn-19811.exe
2680	Unicorn-211.exe
2408	Unicorn-50253.exe
1148	Unicorn-34986.exe
1936	Unicorn-28855.exe
708	Unicorn-50445.exe
996	Unicorn-50445.exe
836	Unicorn-48945.exe
1420	Unicorn-62580.exe
3068	Unicorn-50445.exe
1956	Unicorn-43344.exe
1376	Unicorn-19283.exe
1564	Unicorn-19017.exe
880	Unicorn-55550.exe
1760	Unicorn-40470.exe
752	Unicorn-24217.exe
2204	Unicorn-29366.exe
2808	Unicorn-39463.exe
2748	Unicorn-10974.exe
2976	Unicorn-61581.exe
2760	Unicorn-61846.exe
2696	Unicorn-53398.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2556	2512	3c7f823dc8618dfe5401120937773d60N.exe	30
PID 2512 wrote to memory of 2556	2512	3c7f823dc8618dfe5401120937773d60N.exe	30
PID 2512 wrote to memory of 2556	2512	3c7f823dc8618dfe5401120937773d60N.exe	30
PID 2512 wrote to memory of 2556	2512	3c7f823dc8618dfe5401120937773d60N.exe	30
PID 2556 wrote to memory of 264	2556	Unicorn-34643.exe	32
PID 2556 wrote to memory of 264	2556	Unicorn-34643.exe	32
PID 2556 wrote to memory of 264	2556	Unicorn-34643.exe	32
PID 2556 wrote to memory of 264	2556	Unicorn-34643.exe	32
PID 2512 wrote to memory of 2960	2512	3c7f823dc8618dfe5401120937773d60N.exe	33
PID 2512 wrote to memory of 2960	2512	3c7f823dc8618dfe5401120937773d60N.exe	33
PID 2512 wrote to memory of 2960	2512	3c7f823dc8618dfe5401120937773d60N.exe	33
PID 2512 wrote to memory of 2960	2512	3c7f823dc8618dfe5401120937773d60N.exe	33
PID 2960 wrote to memory of 2948	2960	Unicorn-7271.exe	34
PID 2960 wrote to memory of 2948	2960	Unicorn-7271.exe	34
PID 2960 wrote to memory of 2948	2960	Unicorn-7271.exe	34
PID 2960 wrote to memory of 2948	2960	Unicorn-7271.exe	34
PID 2512 wrote to memory of 2884	2512	3c7f823dc8618dfe5401120937773d60N.exe	35
PID 2512 wrote to memory of 2884	2512	3c7f823dc8618dfe5401120937773d60N.exe	35
PID 2512 wrote to memory of 2884	2512	3c7f823dc8618dfe5401120937773d60N.exe	35
PID 2512 wrote to memory of 2884	2512	3c7f823dc8618dfe5401120937773d60N.exe	35
PID 2556 wrote to memory of 2648	2556	Unicorn-34643.exe	36
PID 2556 wrote to memory of 2648	2556	Unicorn-34643.exe	36
PID 2556 wrote to memory of 2648	2556	Unicorn-34643.exe	36
PID 2556 wrote to memory of 2648	2556	Unicorn-34643.exe	36
PID 264 wrote to memory of 2644	264	Unicorn-59233.exe	37
PID 264 wrote to memory of 2644	264	Unicorn-59233.exe	37
PID 264 wrote to memory of 2644	264	Unicorn-59233.exe	37
PID 264 wrote to memory of 2644	264	Unicorn-59233.exe	37
PID 2948 wrote to memory of 2672	2948	Unicorn-30220.exe	38
PID 2948 wrote to memory of 2672	2948	Unicorn-30220.exe	38
PID 2948 wrote to memory of 2672	2948	Unicorn-30220.exe	38
PID 2948 wrote to memory of 2672	2948	Unicorn-30220.exe	38
PID 2960 wrote to memory of 1288	2960	Unicorn-7271.exe	39
PID 2960 wrote to memory of 1288	2960	Unicorn-7271.exe	39
PID 2960 wrote to memory of 1288	2960	Unicorn-7271.exe	39
PID 2960 wrote to memory of 1288	2960	Unicorn-7271.exe	39
PID 2884 wrote to memory of 1684	2884	Unicorn-24281.exe	40
PID 2884 wrote to memory of 1684	2884	Unicorn-24281.exe	40
PID 2884 wrote to memory of 1684	2884	Unicorn-24281.exe	40
PID 2884 wrote to memory of 1684	2884	Unicorn-24281.exe	40
PID 2512 wrote to memory of 1988	2512	3c7f823dc8618dfe5401120937773d60N.exe	41
PID 2512 wrote to memory of 1988	2512	3c7f823dc8618dfe5401120937773d60N.exe	41
PID 2512 wrote to memory of 1988	2512	3c7f823dc8618dfe5401120937773d60N.exe	41
PID 2512 wrote to memory of 1988	2512	3c7f823dc8618dfe5401120937773d60N.exe	41
PID 2556 wrote to memory of 2836	2556	Unicorn-34643.exe	42
PID 2556 wrote to memory of 2836	2556	Unicorn-34643.exe	42
PID 2556 wrote to memory of 2836	2556	Unicorn-34643.exe	42
PID 2556 wrote to memory of 2836	2556	Unicorn-34643.exe	42
PID 264 wrote to memory of 3016	264	Unicorn-59233.exe	43
PID 264 wrote to memory of 3016	264	Unicorn-59233.exe	43
PID 264 wrote to memory of 3016	264	Unicorn-59233.exe	43
PID 264 wrote to memory of 3016	264	Unicorn-59233.exe	43
PID 2648 wrote to memory of 2008	2648	Unicorn-10546.exe	44
PID 2648 wrote to memory of 2008	2648	Unicorn-10546.exe	44
PID 2648 wrote to memory of 2008	2648	Unicorn-10546.exe	44
PID 2648 wrote to memory of 2008	2648	Unicorn-10546.exe	44
PID 2672 wrote to memory of 2716	2672	Unicorn-2249.exe	45
PID 2672 wrote to memory of 2716	2672	Unicorn-2249.exe	45
PID 2672 wrote to memory of 2716	2672	Unicorn-2249.exe	45
PID 2672 wrote to memory of 2716	2672	Unicorn-2249.exe	45
PID 2948 wrote to memory of 2360	2948	Unicorn-30220.exe	46
PID 2948 wrote to memory of 2360	2948	Unicorn-30220.exe	46
PID 2948 wrote to memory of 2360	2948	Unicorn-30220.exe	46
PID 2948 wrote to memory of 2360	2948	Unicorn-30220.exe	46

C:\Users\Admin\AppData\Local\Temp\3c7f823dc8618dfe5401120937773d60N.exe
"C:\Users\Admin\AppData\Local\Temp\3c7f823dc8618dfe5401120937773d60N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34643.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34643.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59233.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
        8⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        8⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        8⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8008.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe
        7⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        8⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        7⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe
        6⤵
        Executes dropped EXE
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe
        7⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        7⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
        6⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        7⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        7⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 188
        7⤵
        Program crash
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
        6⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
        7⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29659.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21239.exe
        5⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
        8⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40626.exe
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        7⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        7⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5428 -s 188
        8⤵
        Program crash
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-278.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        6⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65404.exe
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6994.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43916.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6362.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1748.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63019.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12502.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
        6⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8008.exe
        7⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47985.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7032.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        5⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31416.exe
        5⤵
        
        PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        5⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        5⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51343.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        6⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27469.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
      4⤵
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45421.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28040.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
      4⤵
      PID:6152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        8⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
        8⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        8⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        7⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        7⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 188
        8⤵
        Program crash
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62635.exe
        6⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38123.exe
        7⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        7⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
        6⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24951.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26362.exe
        6⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        7⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        7⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        6⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18352.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        6⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60377.exe
        5⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        6⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 188
        7⤵
        Program crash
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41915.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        5⤵
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39365.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 240
        5⤵
        Program crash
        
        PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
        5⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46847.exe
        6⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        6⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52884.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18283.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        5⤵
        
        PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
      4⤵
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        5⤵
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44284.exe
      4⤵
      PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63156.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        6⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        7⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36982.exe
        8⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        8⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        8⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33089.exe
        7⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
        7⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30827.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        6⤵
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13517.exe
        5⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44340.exe
        6⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57203.exe
        5⤵
        
        PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
      4⤵
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        5⤵
        
        PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43895.exe
      4⤵
      PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
      4⤵
      PID:6800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9398.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5389.exe
        5⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48834.exe
        6⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        6⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        5⤵
        
        PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58184.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
      4⤵
      PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43320.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54226.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
      4⤵
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32207.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        5⤵
        
        PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
      4⤵
      PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
      4⤵
      PID:6880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41041.exe
    3⤵
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
      4⤵
      PID:6640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
    3⤵
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
    3⤵
    PID:6184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2249.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        8⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49873.exe
        8⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        8⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        8⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        7⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        7⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        6⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40611.exe
        7⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        7⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        7⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48955.exe
        7⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19858.exe
        8⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
        8⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        7⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
        6⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8178.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        7⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36693.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39463.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        6⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        7⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        6⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        5⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18602.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28126.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53398.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18632.exe
        7⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        8⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        8⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        7⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        6⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        6⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        6⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 188
        7⤵
        Program crash
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40261.exe
        6⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        5⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1748.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        5⤵
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
        6⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42825.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62278.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24097.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
      4⤵
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        5⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4617.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43370.exe
      4⤵
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
      4⤵
      PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        6⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57950.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        7⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        7⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56757.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        6⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37625.exe
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64757.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38499.exe
        5⤵
        
        PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17092.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
      4⤵
      PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36631.exe
      4⤵
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
      4⤵
      PID:6588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-205.exe
        5⤵
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        6⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23224.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65078.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38835.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
      4⤵
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19017.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
      4⤵
      PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65358.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
      4⤵
      PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
    3⤵
    PID:284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40611.exe
      4⤵
      PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3744.exe
    3⤵
    PID:768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28040.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47397.exe
    3⤵
    PID:5436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53378.exe
        6⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe
        6⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32207.exe
        6⤵
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        6⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43916.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13907.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
        5⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39603.exe
        6⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        5⤵
        
        PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15027.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        5⤵
        
        PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10833.exe
      4⤵
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        5⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4415.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60794.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21245.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42790.exe
        5⤵
        
        PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
      4⤵
      PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
      4⤵
      PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63751.exe
        5⤵
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        6⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        5⤵
        
        PID:5684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 188
        6⤵
        Program crash
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6496.exe
      4⤵
      PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
        5⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65030.exe
      4⤵
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43881.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58184.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
      4⤵
      PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55264.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
      4⤵
      PID:5460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
    3⤵
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51343.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44798.exe
      4⤵
      PID:6248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
    3⤵
    PID:5100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
    3⤵
    PID:6360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59815.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59815.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-205.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
        6⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        7⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        5⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38816.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18283.exe
        5⤵
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26141.exe
      4⤵
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
        5⤵
        
        PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61184.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
      4⤵
      PID:6508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40611.exe
      4⤵
      PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37288.exe
      4⤵
      PID:7116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34480.exe
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46153.exe
    3⤵
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
    3⤵
    PID:5704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
      4⤵
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51022.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
      4⤵
      PID:5748
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 188
        5⤵
        Program crash
        
        PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37625.exe
    3⤵
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
      4⤵
      PID:6616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
    3⤵
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
    3⤵
    PID:4936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
    3⤵
    PID:6432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43344.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43344.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
    3⤵
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
      4⤵
      PID:7128
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 188
        5⤵
        Program crash
        
        PID:6692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
    3⤵
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exe
    3⤵
    PID:6148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe
  2⤵
  PID:1300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6965.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6965.exe
  2⤵
  PID:3124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
  2⤵
  PID:5144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
  2⤵
  PID:6448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe

Filesize
468KB

MD5
4c0925cab921f18cd0035eca94238435

SHA1
5f1c055396d0df48e299560f53b0aaa3206cb579

SHA256
ecde4a405e533cd5e068207c25699954b31192dc769e233ddadfbe069ab62b33

SHA512
fcfb0d65a6dae34af31a4c7c85b2ac8450e858dd2b7a50d5a3b39dfe4d4333658387812499c4f713ea1fed41d2511ae63974a9ebf49f87100427e93d25949d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe

Filesize
468KB

MD5
b609e6a7606e6eea81954ebcf240d924

SHA1
852d98ae1f154fcdb416ce6d54b352556ccb8428

SHA256
cbe95a7e021ddf6b2a975dc2cabfe5151842d5bb761199df08cd159179a24ba1

SHA512
bb4c44a98b245b04b87dcaad770cf327a5facffcc610134009a1c53f6673d8dd129d878e2cfe72e93ae0e6121717928006b1631c350833a81d1a9c59a9c0c6e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe

Filesize
468KB

MD5
c996d8384ac415940826383cc58b4d17

SHA1
794af239f4490d39908b1e118ea6cad325c2e696

SHA256
571b5ccdbeec24127389e1122a734a3b17310b6763e4afca2e57df89b8b0a8ee

SHA512
a0e185cd9d2e86ee96324afcc4c6ef1776331a715c6db92fd3d867241a76b9cf2f792c335691500dac0596799b423d29823ba0c84ab63239eda87d258f043cc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe

Filesize
468KB

MD5
f94d44ab4d692f896d77658ce73da5cf

SHA1
7d6ae08e5c6ed4fd3ffec1f19d679f734d9ec68b

SHA256
2106fac81f927c5daf7270f790154f3cb93a2f0055d1da562088b55488a5d945

SHA512
189b101c611316af9a58233f13fb4a593c302ed77c1aa5eeb1150c0db57c66a54e8e1979e42c8db24b4602b0fdb9f9e58e8b0319f31d4617e6d9ff2dc9653cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59815.exe

Filesize
468KB

MD5
f021ebc120bbbb8f66ecb881dde93a41

SHA1
43678d6cf7a68ad463d31a31a31a24cd14ad4964

SHA256
d1538d54bf9c28e780b43706891d51ff4a614f3ec10c367a37779918a0947cad

SHA512
244b228b86b18ce0c3d32439da8710d4c4157cfcee50b694f019efed3f641f957ca0bdee889d168d782cfd20b3f1265ceef5657891a2970fb26a53bd4dceada6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe

Filesize
468KB

MD5
bdc34f1a3133df68bc8769fbf65c1e9e

SHA1
e43c452361bcbd2973f09e4bac58b1c8b3884887

SHA256
5b9f336d244c26a8bc12fa19796ef6e38d8116fb744163e2ae56102d0531ef34

SHA512
86200267a41da79feea3b7c6ecc64c9d948ded8d01de061d4c6c26fb83ca17768cf0736b2d35f350e19f5efe16d008e679aa251d11727da9d4bd7b2f716b552f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe

Filesize
468KB

MD5
13a5a2ae8b0f084739d87e500480204c

SHA1
945f77eb8c5a9045d2118b441a589afeb68be5f3

SHA256
dc19530424cef66b1d09157afa3d5043822c790e29fa828dd875f68dedb88822

SHA512
02b1e412415353226e39c2cbb50b6da32222f773c5e0e454b21644286e34419dffe7a304e5e42a44fe29c4eee08b44083ddf30f80bb350c5de250f710fc9330e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe

Filesize
468KB

MD5
d055e060ce010b1122da9838945f8c5e

SHA1
6a01ad60a5744fa9389c283b40fd7f50feeab305

SHA256
f2969c3e2ee5dc91eb3e64dbe536257a8cbd0413db318eae7776abe00a1df4b3

SHA512
1ed8825d8fb3082448832c7fdfc8197eacd79c23e5cf043e8c0d99cb36892514d02aa1934d1334605d9546877f9a2273886bd515cba8c8e1910d50cf3635a9d4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2249.exe

Filesize
468KB

MD5
77d566f454abb81266bfae264347b0c7

SHA1
395eb59abf52046e6bb43dfe84371235d49ccd56

SHA256
219911147da97d12a280ad207f68f81b360f73bf139fdb9fd6ab32f6c9010868

SHA512
8091cd781d017088a621bc94e1550db11dafc370b293e1f155cf219b7c2013ecbf0e52d06e12a23c7dee69c4fe3ed8f8d576b020c54c0ac4bea1aa0459af1c19

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe

Filesize
468KB

MD5
3cc39040b8ead017bf9d0696bdaf6015

SHA1
1af02c4349a9b83b7c3810b33781f69fd1560449

SHA256
77b4b430a6ed824bc32e0ac2e6fd47a537e709d904b46da16511259520d42573

SHA512
e7402265b2ddd38aa2f1ed4d00889d3469defa35f8e46c5538c06a1b8fa250e03b9e8d7d3592a69202ce16ace180f4014522834ab74a0cf9409248371b46edf2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe

Filesize
468KB

MD5
a791352a56c2f18ed5685eea3531d4d6

SHA1
b332ac9226791696a123eaca8e76ed269bbcdfb4

SHA256
553d1fcbbb0eaac9dca0ce3ef299bd32036cab3f8b6025a854586f7ad60d59e0

SHA512
7af28822a26f67ccf8fcb12196c476bab8d6771cdf4d215881b02bab1420663d95df3416a75e613e205076a29142b0f6d6f155ffecae606622a291c6da6a3391

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe

Filesize
468KB

MD5
6a5df46d917e9103c4dd08c7b05bc25d

SHA1
46b7f0ce7a63afa6e9297ed86e198e6584aa0026

SHA256
885dae5afc546caa5f6fbd831d7f53b2a22dd0714320c4f161b5a17d43b20ca3

SHA512
9e018014cf4c0761e5774f9123bee8fe09b115e15b8b228176735724c8d0bc7b11453c03e0e8af2c4ffd09042424052f0642d7289d6473df67e2e1ab84137026

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28126.exe

Filesize
468KB

MD5
d26124e0a0fb9d7fb15ee0c85127e5c8

SHA1
1302e81438a4535a0773f63e80e2f93f1a6600d6

SHA256
e9841e58fecb593de4658c935527c14343445dc437c47dba5b1a538ba5fb5b50

SHA512
2100d2c337576b08e1daef0242f7645213c2fa2daf1c084a4f9f0b383b4e03812f52f2c54abe66e649139bb9b92ea13f8b8700dc33cd91d7a0fde1a9ff8a1105

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe

Filesize
468KB

MD5
34f035ae50fce3e8c8c515d31b7d2129

SHA1
1d8acc0c8392220c5b6877ea5d6e2120d5961d72

SHA256
97ecedb45a129d339205e4fa5b7c93ca74e0376ab666f6118f1b058c25cc1be7

SHA512
8342a57ffcd74dd60940aafc49a8bface0eb8ea54be79b6d7567586407f1900843fb1cc8ea65bb644771ecd5658e6958c1e36afe33f340644e89ccfc1187a6e2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34643.exe

Filesize
468KB

MD5
d849e6c6de4601aa14e6aba45fd2f85a

SHA1
6a520eeb9db2f2229d82025c7b179bf05ce147a1

SHA256
6db7c84156ab4ccc963b046005979db8da9756310e675a7aeded20131564a133

SHA512
d1ae1ac13ac1485ec4869ae2978b6bf4ca8155614f8029951641d5da19b4c3b332ff1335dceed8c3474cbaf43e05580e1941370e44679c66492d687b7fa5223b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe

Filesize
468KB

MD5
570808a65d8d3cc65b57a55ab4e5487e

SHA1
87a747f4e1620328ab211c3ebd0a7e205dbdedce

SHA256
c182a16240d0d27ee7b81367e78bd36a2db5482e28ea3e85a037bc0532baf4b9

SHA512
b77a6c8af097e0a5a7757d07ee45cc92c80dcc023fe94a0bbe2358a15e33aa0aac7278c2ee13638bbfde53a18376682304d5390cc5974fe93a5d090d4840eade

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59233.exe

Filesize
468KB

MD5
bb6eafe625c4e57383e57fb52894c780

SHA1
027fe3c74b480fdf655ec3c90914449fb610e981

SHA256
f30cd2273fe1254a915bffdb2e4fbd0e5dbbcd2c8c82dc20654286972400025a

SHA512
843962831f52e82506f4bcb4b0a79a43f74cf21c249ee585ceaccb24684a2274e7eed8a69dc67758318e083d953f340d760ca6416a1b6c91d1b46204953820fc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe

Filesize
468KB

MD5
5629b41b3dd7e6f5932914d9addb0452

SHA1
9172d681427a2fbcba7e3d353c4758841ef038a2

SHA256
0d9089de3c12795ee2e2a63aa5c2f0f7c3b5c9345713fbf88a7c020d134837e5

SHA512
a01687b82c587d501d9367c57c72ba5673f271a1c5a3ba50c2ee8c4c7d7542b28d0eac53236261e1b9495205534bb47e7c2b34bf74f6099de3eca657984c4649

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe

Filesize
468KB

MD5
2cb1734aa1165ae6dc7068ffc1845a60

SHA1
69918c76e921e9539347a2f92c1af4fec8877776

SHA256
9cf0a0c37ef8e5462d637c2f4528f2ef76012c23b17e9884f5addf38031b942a

SHA512
f09f1af9d1f4c0e936111e60d515e4bdb9ec97de560acb7985a1dbb5b686aefec584d6db98c0d79fb736de2b3ad7844cb44dfcd4a757b9015092f3f13841ea8b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe

Filesize
468KB

MD5
760438d74b39317250e3e96eef7b8c10

SHA1
19b542933f3218eb13c7c6a8bedacb4b576dda7e

SHA256
a4f4c260d8f787af2ed096ae06f59c6bba5d2976120572ca2e748e520ea364be

SHA512
afb32fc466fa877a53dc9b721922c6c1c508c2d8cb33b76bc41fc3a7f4bcae792b212e28d3d26942853c39d3e6b56d07b6e82ee109e61bf7e78626c1a062e769

Download Submit
memory/236-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/264-264-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/264-151-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/264-256-0x00000000027C0000-0x0000000002835000-memory.dmp

Filesize
468KB

Download
memory/264-163-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/772-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/892-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1092-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-348-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/1136-343-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/1156-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1224-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1224-363-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1224-367-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1288-288-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/1288-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1288-281-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/1332-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1684-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1684-248-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/1684-245-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/1712-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-246-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/1988-244-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/1988-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-224-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2008-377-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2008-223-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2008-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-386-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2276-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-324-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/2360-332-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/2360-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-404-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2456-385-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2456-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-32-0x00000000006D0000-0x0000000000745000-memory.dmp

Filesize
468KB

Download
memory/2512-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-132-0x00000000006D0000-0x0000000000745000-memory.dmp

Filesize
468KB

Download
memory/2512-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-250-0x00000000006D0000-0x0000000000745000-memory.dmp

Filesize
468KB

Download
memory/2512-10-0x00000000006D0000-0x0000000000745000-memory.dmp

Filesize
468KB

Download
memory/2512-131-0x00000000006D0000-0x0000000000745000-memory.dmp

Filesize
468KB

Download
memory/2556-285-0x0000000003430000-0x00000000034A5000-memory.dmp

Filesize
468KB

Download
memory/2556-280-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2556-19-0x0000000003630000-0x00000000036A5000-memory.dmp

Filesize
468KB

Download
memory/2556-406-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2556-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-141-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2556-409-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2556-142-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2556-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-211-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/2644-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-205-0x0000000003450000-0x00000000034C5000-memory.dmp

Filesize
468KB

Download
memory/2644-340-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/2644-338-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/2648-164-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2648-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-241-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2648-242-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2648-152-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2672-181-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2672-323-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2672-331-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2672-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-317-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2716-316-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2752-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-282-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2836-283-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2876-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-254-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2884-263-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2884-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-89-0x0000000002180000-0x00000000021F5000-memory.dmp

Filesize
468KB

Download
memory/2948-337-0x0000000001F80000-0x0000000001FF5000-memory.dmp

Filesize
468KB

Download
memory/2948-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-196-0x0000000001F80000-0x0000000001FF5000-memory.dmp

Filesize
468KB

Download
memory/2948-197-0x0000000001F80000-0x0000000001FF5000-memory.dmp

Filesize
468KB

Download
memory/2948-339-0x0000000001F80000-0x0000000001FF5000-memory.dmp

Filesize
468KB

Download
memory/2960-286-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2960-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-278-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/3016-247-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3016-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download