be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c

Analysis

max time kernel
148s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
Size

468KB
MD5

076c508056534423a20fbd4f6983a53a
SHA1

1990b45b4c12261d83e0910450f920ac6f7ba0cb
SHA256

be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c
SHA512

95228306deac5d6e3832f0fba829c05f149a8979c7e74da7515b5f3118c6ad6470aa827f006e747054157530cbbc104afbbba7c29747c7f26eb879dbc89b2728
SSDEEP

3072:O1zhogjdpy8Un+HsPz5FvficfhjWI8DkWHevVp02FU39DYNe0lv:O1NouLUnfP1FvfEx6M2FaNYNe

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3032	Unicorn-9375.exe
2348	Unicorn-63771.exe
2876	Unicorn-1176.exe
2836	Unicorn-46452.exe
1736	Unicorn-9373.exe
2732	Unicorn-8033.exe
2860	Unicorn-29239.exe
2648	Unicorn-34953.exe
2312	Unicorn-54007.exe
1028	Unicorn-.exe
692	Unicorn-12389.exe
968	Unicorn-40847.exe
2796	Unicorn-14262.exe
1540	Unicorn-60905.exe
2212	Unicorn-26374.exe
1520	Unicorn-28376.exe
1840	Unicorn-24353.exe
2808	Unicorn-3674.exe
1356	Unicorn-53788.exe
1380	Unicorn-8884.exe
2028	Unicorn-6123.exe
1108	Unicorn-42652.exe
2272	Unicorn-.exe
2400	Unicorn-37290.exe
2072	Unicorn-.exe
1808	Unicorn-1723.exe
1064	Unicorn-34972.exe
1744	Unicorn-41309.exe
1252	Unicorn-28645.exe
2700	Unicorn-14515.exe
2404	Unicorn-14515.exe
2200	Unicorn-22308.exe
2756	Unicorn-8573.exe
2844	Unicorn-12979.exe
2820	Unicorn-12413.exe
2904	Unicorn-17780.exe
1992	Unicorn-9345.exe
3068	Unicorn-17806.exe
2664	Unicorn-44126.exe
476	Unicorn-9860.exe
1016	Unicorn-5527.exe
2268	Unicorn-15527.exe
2880	Unicorn-23294.exe
956	Unicorn-63851.exe
2224	Unicorn-29425.exe
764	Unicorn-63851.exe
1828	Unicorn-29425.exe
2552	Unicorn-27566.exe
2152	Unicorn-27566.exe
2712	Unicorn-48136.exe
1368	Unicorn-64672.exe
2596	Unicorn-8065.exe
1040	Unicorn-21697.exe
1780	Unicorn-.exe
1216	Unicorn-.exe
912	Unicorn-.exe
1548	Unicorn-.exe
1716	Unicorn-6721.exe
2488	Unicorn-23560.exe
1608	Unicorn-55974.exe
2316	Unicorn-47702.exe
2240	Unicorn-21766.exe
2824	Unicorn-52144.exe
2804	Unicorn-7240.exe

Loads dropped DLL 64 IoCs

pid	Process
632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
3032	Unicorn-9375.exe
3032	Unicorn-9375.exe
632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
2348	Unicorn-63771.exe
2348	Unicorn-63771.exe
3032	Unicorn-9375.exe
3032	Unicorn-9375.exe
2876	Unicorn-1176.exe
2876	Unicorn-1176.exe
632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
1736	Unicorn-9373.exe
1736	Unicorn-9373.exe
3032	Unicorn-9375.exe
3032	Unicorn-9375.exe
2860	Unicorn-29239.exe
2732	Unicorn-8033.exe
2860	Unicorn-29239.exe
2732	Unicorn-8033.exe
2876	Unicorn-1176.exe
2876	Unicorn-1176.exe
632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
2836	Unicorn-46452.exe
2836	Unicorn-46452.exe
2348	Unicorn-63771.exe
2348	Unicorn-63771.exe
2648	Unicorn-34953.exe
2648	Unicorn-34953.exe
1736	Unicorn-9373.exe
1736	Unicorn-9373.exe
692	Unicorn-12389.exe
692	Unicorn-12389.exe
2732	Unicorn-8033.exe
2732	Unicorn-8033.exe
2312	Unicorn-54007.exe
2312	Unicorn-54007.exe
3032	Unicorn-9375.exe
3032	Unicorn-9375.exe
968	Unicorn-40847.exe
968	Unicorn-40847.exe
1028	Unicorn-.exe
2348	Unicorn-63771.exe
2348	Unicorn-63771.exe
2860	Unicorn-29239.exe
2860	Unicorn-29239.exe
2796	Unicorn-14262.exe
2796	Unicorn-14262.exe
1540	Unicorn-60905.exe
1540	Unicorn-60905.exe
632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
2836	Unicorn-46452.exe
2836	Unicorn-46452.exe
1520	Unicorn-28376.exe
1840	Unicorn-24353.exe
1840	Unicorn-24353.exe
1520	Unicorn-28376.exe
2648	Unicorn-34953.exe
1736	Unicorn-9373.exe
1736	Unicorn-9373.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1824	764	WerFault.exe	74
4048	956	WerFault.exe	75
4740	444	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
3032	Unicorn-9375.exe
2348	Unicorn-63771.exe
2876	Unicorn-1176.exe
1736	Unicorn-9373.exe
2860	Unicorn-29239.exe
2836	Unicorn-46452.exe
2732	Unicorn-8033.exe
2648	Unicorn-34953.exe
1028	Unicorn-.exe
2312	Unicorn-54007.exe
692	Unicorn-12389.exe
1540	Unicorn-60905.exe
2212	Unicorn-26374.exe
968	Unicorn-40847.exe
2796	Unicorn-14262.exe
1840	Unicorn-24353.exe
1520	Unicorn-28376.exe
2808	Unicorn-3674.exe
1356	Unicorn-53788.exe
1380	Unicorn-8884.exe
2028	Unicorn-6123.exe
1064	Unicorn-34972.exe
1744	Unicorn-41309.exe
1808	Unicorn-1723.exe
2400	Unicorn-37290.exe
1252	Unicorn-28645.exe
1108	Unicorn-42652.exe
2072	Unicorn-.exe
2272	Unicorn-.exe
2700	Unicorn-14515.exe
2404	Unicorn-14515.exe
2756	Unicorn-8573.exe
2844	Unicorn-12979.exe
2820	Unicorn-12413.exe
1992	Unicorn-9345.exe
2904	Unicorn-17780.exe
2200	Unicorn-22308.exe
3068	Unicorn-17806.exe
2664	Unicorn-44126.exe
476	Unicorn-9860.exe
1016	Unicorn-5527.exe
2268	Unicorn-15527.exe
2712	Unicorn-48136.exe
1828	Unicorn-29425.exe
2552	Unicorn-27566.exe
764	Unicorn-63851.exe
2152	Unicorn-27566.exe
2224	Unicorn-29425.exe
956	Unicorn-63851.exe
2880	Unicorn-23294.exe
1368	Unicorn-64672.exe
2596	Unicorn-8065.exe
1216	Unicorn-.exe
1040	Unicorn-21697.exe
1780	Unicorn-.exe
912	Unicorn-.exe
1548	Unicorn-.exe
1716	Unicorn-6721.exe
2488	Unicorn-23560.exe
1608	Unicorn-55974.exe
2316	Unicorn-47702.exe
2240	Unicorn-21766.exe
2804	Unicorn-7240.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3032	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	30
PID 632 wrote to memory of 3032	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	30
PID 632 wrote to memory of 3032	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	30
PID 632 wrote to memory of 3032	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	30
PID 3032 wrote to memory of 2348	3032	Unicorn-9375.exe	31
PID 3032 wrote to memory of 2348	3032	Unicorn-9375.exe	31
PID 3032 wrote to memory of 2348	3032	Unicorn-9375.exe	31
PID 3032 wrote to memory of 2348	3032	Unicorn-9375.exe	31
PID 632 wrote to memory of 2876	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	32
PID 632 wrote to memory of 2876	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	32
PID 632 wrote to memory of 2876	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	32
PID 632 wrote to memory of 2876	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	32
PID 2348 wrote to memory of 2836	2348	Unicorn-63771.exe	33
PID 2348 wrote to memory of 2836	2348	Unicorn-63771.exe	33
PID 2348 wrote to memory of 2836	2348	Unicorn-63771.exe	33
PID 2348 wrote to memory of 2836	2348	Unicorn-63771.exe	33
PID 3032 wrote to memory of 1736	3032	Unicorn-9375.exe	34
PID 3032 wrote to memory of 1736	3032	Unicorn-9375.exe	34
PID 3032 wrote to memory of 1736	3032	Unicorn-9375.exe	34
PID 3032 wrote to memory of 1736	3032	Unicorn-9375.exe	34
PID 2876 wrote to memory of 2860	2876	Unicorn-1176.exe	35
PID 2876 wrote to memory of 2860	2876	Unicorn-1176.exe	35
PID 2876 wrote to memory of 2860	2876	Unicorn-1176.exe	35
PID 2876 wrote to memory of 2860	2876	Unicorn-1176.exe	35
PID 632 wrote to memory of 2732	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	36
PID 632 wrote to memory of 2732	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	36
PID 632 wrote to memory of 2732	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	36
PID 632 wrote to memory of 2732	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	36
PID 1736 wrote to memory of 2648	1736	Unicorn-9373.exe	37
PID 1736 wrote to memory of 2648	1736	Unicorn-9373.exe	37
PID 1736 wrote to memory of 2648	1736	Unicorn-9373.exe	37
PID 1736 wrote to memory of 2648	1736	Unicorn-9373.exe	37
PID 3032 wrote to memory of 2312	3032	Unicorn-9375.exe	38
PID 3032 wrote to memory of 2312	3032	Unicorn-9375.exe	38
PID 3032 wrote to memory of 2312	3032	Unicorn-9375.exe	38
PID 3032 wrote to memory of 2312	3032	Unicorn-9375.exe	38
PID 2860 wrote to memory of 1028	2860	Unicorn-29239.exe	39
PID 2860 wrote to memory of 1028	2860	Unicorn-29239.exe	39
PID 2860 wrote to memory of 1028	2860	Unicorn-29239.exe	39
PID 2860 wrote to memory of 1028	2860	Unicorn-29239.exe	39
PID 2732 wrote to memory of 692	2732	Unicorn-8033.exe	40
PID 2732 wrote to memory of 692	2732	Unicorn-8033.exe	40
PID 2732 wrote to memory of 692	2732	Unicorn-8033.exe	40
PID 2732 wrote to memory of 692	2732	Unicorn-8033.exe	40
PID 2876 wrote to memory of 968	2876	Unicorn-1176.exe	41
PID 2876 wrote to memory of 968	2876	Unicorn-1176.exe	41
PID 2876 wrote to memory of 968	2876	Unicorn-1176.exe	41
PID 2876 wrote to memory of 968	2876	Unicorn-1176.exe	41
PID 632 wrote to memory of 2796	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	42
PID 632 wrote to memory of 2796	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	42
PID 632 wrote to memory of 2796	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	42
PID 632 wrote to memory of 2796	632	be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe	42
PID 2836 wrote to memory of 1540	2836	Unicorn-46452.exe	43
PID 2836 wrote to memory of 1540	2836	Unicorn-46452.exe	43
PID 2836 wrote to memory of 1540	2836	Unicorn-46452.exe	43
PID 2836 wrote to memory of 1540	2836	Unicorn-46452.exe	43
PID 2348 wrote to memory of 2212	2348	Unicorn-63771.exe	44
PID 2348 wrote to memory of 2212	2348	Unicorn-63771.exe	44
PID 2348 wrote to memory of 2212	2348	Unicorn-63771.exe	44
PID 2348 wrote to memory of 2212	2348	Unicorn-63771.exe	44
PID 2648 wrote to memory of 1520	2648	Unicorn-34953.exe	46
PID 2648 wrote to memory of 1520	2648	Unicorn-34953.exe	46
PID 2648 wrote to memory of 1520	2648	Unicorn-34953.exe	46
PID 2648 wrote to memory of 1520	2648	Unicorn-34953.exe	46

C:\Users\Admin\AppData\Local\Temp\be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe
"C:\Users\Admin\AppData\Local\Temp\be281664a080477fac33caedb7490a5f201510381d47ebdde42bab75adb6af6c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46452.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60905.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63851.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        8⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 236
        8⤵
        Program crash
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5010.exe
        7⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
        7⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2691.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8700.exe
        7⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe
        7⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        8⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        8⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        8⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62762.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59367.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        7⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57556.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49541.exe
        7⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20051.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        6⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58196.exe
        7⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        7⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        6⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
        6⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51015.exe
        6⤵
        
        PID:492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        5⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26374.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44126.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4892.exe
        6⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
        7⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        7⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
        6⤵
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        6⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8295.exe
        5⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12706.exe
        6⤵
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26330.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        6⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21974.exe
        5⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        5⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        5⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37290.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        6⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        7⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
        6⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22832.exe
        5⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9116.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        6⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7627.exe
        6⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        5⤵
        
        PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21697.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64228.exe
        5⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6228.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20272.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7627.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28749.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        5⤵
        
        PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exe
      4⤵
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        5⤵
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57556.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        6⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        6⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        5⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        5⤵
        
        PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9853.exe
      4⤵
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
        5⤵
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
      4⤵
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
      4⤵
      PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38752.exe
      4⤵
      PID:7196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34953.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28376.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21766.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        8⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
        8⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        7⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        7⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
        6⤵
        Executes dropped EXE
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        7⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45442.exe
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        7⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        7⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28280.exe
        6⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        7⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62340.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25696.exe
        6⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        6⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        7⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exe
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        6⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44398.exe
        5⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42780.exe
        6⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26330.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        6⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        5⤵
        
        PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        5⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14540.exe
        5⤵
        
        PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55974.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
        7⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        7⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        6⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
        6⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47702.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
        6⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19875.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        5⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        6⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        6⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
        5⤵
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26247.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        5⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        5⤵
        
        PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        5⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49733.exe
        5⤵
        
        PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35036.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
      4⤵
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
      4⤵
      PID:7632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        6⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24210.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe
        7⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43868.exe
        7⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        6⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
        5⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1397.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38134.exe
        6⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5226.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17893.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8349.exe
        5⤵
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        5⤵
        
        PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5527.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        5⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        6⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48503.exe
        6⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43084.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
        6⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        5⤵
        
        PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
      4⤵
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        5⤵
        
        PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        5⤵
        
        PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
      4⤵
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
      4⤵
      PID:7524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        5⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        5⤵
        
        PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32327.exe
      4⤵
      PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      4⤵
      PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
      4⤵
      PID:7448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
      4⤵
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        5⤵
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8043.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        5⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      4⤵
      PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
      4⤵
      PID:7360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47579.exe
    3⤵
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
      4⤵
      PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      4⤵
      PID:7584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exe
    3⤵
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
    3⤵
    PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12358.exe
    3⤵
    PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
    3⤵
    PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53416.exe
    3⤵
    PID:7376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        8⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        8⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        8⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        7⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      4⤵
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      4⤵
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
      4⤵
      PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42652.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6721.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22832.exe
        6⤵
        
        PID:416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        7⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1661.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        6⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10657.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        6⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
        6⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53805.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        5⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe
        6⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        6⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
        6⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
      4⤵
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13949.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        5⤵
        
        PID:7368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20051.exe
      4⤵
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
      4⤵
      PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
      4⤵
      PID:7904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21472.exe
      4⤵
      PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      4⤵
      PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
      4⤵
      PID:7320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
    3⤵
    PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
    3⤵
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
    3⤵
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13493.exe
    3⤵
    PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
    3⤵
    PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
    3⤵
    PID:7232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8033.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8033.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        6⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
        7⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        7⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        6⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
        6⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        5⤵
        
        PID:676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
        6⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exe
        5⤵
        
        PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16805.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        5⤵
        
        PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12413.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7240.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exe
        6⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12512.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        6⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32869.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        5⤵
        
        PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
      4⤵
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        5⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        5⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
      4⤵
      PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
      4⤵
      PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
      4⤵
      PID:7648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53788.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16839.exe
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60647.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49541.exe
        6⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53805.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        5⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
      4⤵
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11768.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24350.exe
        5⤵
        
        PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10960.exe
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      4⤵
      PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
      4⤵
      PID:7592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9345.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
      4⤵
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
        5⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        5⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        5⤵
        
        PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
      4⤵
      PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      4⤵
      PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      4⤵
      PID:7516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
    3⤵
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57556.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
      4⤵
      PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
      4⤵
      PID:8080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe
    3⤵
    PID:5364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
    3⤵
    PID:6504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
    3⤵
    PID:7640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63851.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13076.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20325.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 236
        6⤵
        Program crash
        
        PID:4740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 236
        5⤵
        Program crash
        
        PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
      4⤵
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27713.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        5⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20109.exe
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
      4⤵
      PID:7268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
      4⤵
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
        5⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
        5⤵
        
        PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
      4⤵
      PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
      4⤵
      PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      4⤵
      PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
      4⤵
      PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
    3⤵
    PID:580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      4⤵
      PID:7480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
    3⤵
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23447.exe
    3⤵
    PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50291.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
    3⤵
    PID:7616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35998.exe
      4⤵
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6228.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4813.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        5⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40876.exe
        5⤵
        
        PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35994.exe
      4⤵
      PID:532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
      4⤵
      PID:7260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
    3⤵
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13949.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
      4⤵
      PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49541.exe
      4⤵
      PID:7556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
    3⤵
    PID:4644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32869.exe
    3⤵
    PID:5404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
    3⤵
    PID:6496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
    3⤵
    PID:7392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48136.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48136.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35396.exe
    3⤵
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7145.exe
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53894.exe
        5⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        5⤵
        
        PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47898.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
      4⤵
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32192.exe
      4⤵
      PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
      4⤵
      PID:7876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45682.exe
    3⤵
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22026.exe
      4⤵
      PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
      4⤵
      PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51374.exe
      4⤵
      PID:7932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
    3⤵
    PID:4652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
    3⤵
    PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
    3⤵
    PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
    3⤵
    PID:7832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
  2⤵
  PID:932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
    3⤵
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
    3⤵
    PID:6648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
    3⤵
    PID:6964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
  2⤵
  PID:2280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
  2⤵
  PID:3636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exe
  2⤵
  PID:4164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe
  2⤵
  PID:5380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
  2⤵
  PID:5992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53741.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53741.exe
  2⤵
  PID:7716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe

Filesize
468KB

MD5
a0ab712c347eaf1ac148a18d39272797

SHA1
0cacba0bf5389639f26dbc4ccf54c4c2a95d56d0

SHA256
c77dac0b3e2ac43d1310524a6981c036a3fe13e442fd71bb0843413259bc9eb0

SHA512
c4c50219e1ffe661688b578b69cc90761238c8befbbace6be53f54596fab7c8940e5adeff1b3a1bd26c07a79fceb34a54f1f9fa468c6835f1736dd088a27cb28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe

Filesize
468KB

MD5
a2ae2404e2779f286d2ed63c2501751b

SHA1
c6fc021260fccd428fe552ca8906148c23252c31

SHA256
db5d8b17c9502384312f7f0f935560bccd3d69eeeddbf0d3ccd9cf1279e7fd53

SHA512
48020b8b21717ec13edaf30ca21fe598bbed259f29da5a1a314fd6fdb546396dc77c9184b31deb66d8d1fd977e03b97d284945a0d7ced63e1b5c0d86e5db1088

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe

Filesize
468KB

MD5
55c29690b600a4ebef1bdac91ef18a15

SHA1
9a650d40a9c91ad02d04cfb9718a4c34bdebfe8f

SHA256
5b5d2024bd9514c113fe4386747639505cd04d7d31d45371a32ad3492c082def

SHA512
25d7649a69bcee80a33803b5a2d1f98cdf28a970b2bf66535b93f372c218caf900fe89b66861d474fd590e84953ab70601955ce719f1a01fe0567278fb538b76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8033.exe

Filesize
468KB

MD5
930c1d1861b366f3d8203ee7f9134a3f

SHA1
b14040bd8df556e00ecd0959f3c9a442cd297877

SHA256
a2dfd106fbb8a3e030150bab98373e88f2cd6abc06b352f494474926ea01db1e

SHA512
1637fbad336b91109fdaccbf02caf70b8c7c006ad71a7feb4beef52fa406d56f4bc3cb3eb3b16a983b86542ded26408854e28f43776417e1fb10a922621b82b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9345.exe

Filesize
468KB

MD5
3b25b2a1d5a77ccaf78245dad21f9a28

SHA1
df75633d421cccf4926a0e49cf8b68f3c042c5ef

SHA256
db32144bb5fff2c310f887688f1b62013cd8c731bb546df08380288757609c05

SHA512
56f9fbba130dde63a6d3daf4e6fc856bd44c50e6bc1587bb54347012d6f6ffe319f12d741e8d5641119fd967a063438d6293b9d7916eb3876b2a3ee16f08d597

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-.exe

Filesize
468KB

MD5
4ab29db9ccb3101bc5bd5993572e72d2

SHA1
641f18ea77179c9fbfd3802d5a9deb3e114a6616

SHA256
6d9a9db6b610aec59a1840376587a5e77edac0886e39ff96104c0eb2654bbaa0

SHA512
bb34b45f89132ada864f9a6b784c7ac9ebaf5f8b76fec47192a7ac3f1c890aa79fb8843bfecdbc3a5ee08da06eef19b1f798574581efd8599a205febc2985377

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe

Filesize
468KB

MD5
19e37e8017b333b7cb6c90595f21967b

SHA1
624714701fcb96c650890b746fe933ef9ef14cfc

SHA256
dae7a663e0bac298a7f19eec0c56862c602e40138c4c9f89a423715552725268

SHA512
d7e58f22e70962ac87054435f38b7848a4f22a3258991dbf3676397629016967c87e13f29285e3494baa19b75075ef5b5f17e69b59a2ba6aab95c624650acbad

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe

Filesize
468KB

MD5
1fd210be29a864415e21551ac306ddc9

SHA1
d8ed28480d4c3169a5f8dfbefc86f3ba9966b436

SHA256
31bd385dc3c628add0ce85a0fa6a206c51c9f6360c90c9926581535333353911

SHA512
e601cda6f91782d99d3447a8794427d0cd7a2f36f522bcc7fe5c7bebdc76d5ab33a025b4ae589689d8cc1465ed4fcbeadb8455ef0b05e11eeae2f3b030c2e366

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26374.exe

Filesize
468KB

MD5
fbb30207f03a6b534ee9269c7010ab90

SHA1
12e35bd6d783c27340b4519b503e098e3ec4976a

SHA256
5fcabc63032fc430fe316e9f406cce90db3a33a07dcfc0f607531d3e6e4a046d

SHA512
cd25d9ae221c2d801be28326c2a8551f9d7359d4d9101a540a97c578ae2aa07fb43ce0f81852847fc0193cfa0257e97c3e1f144bb3b9bbb6e0e3c5a02b101e0f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28376.exe

Filesize
468KB

MD5
e00c9800f34145ee70507d6065a529e7

SHA1
8ca22895b1dca699bc1f5a958001b280125caa27

SHA256
7ff5ab849733f1a86680d119270d69e89890f507383f4720ec523eeb0873ebc3

SHA512
732232939f9b15afc0536edb52c6c7bdbfc8f91526f533f58712fe08b8c6a37fe7ad7bd1a007d8b8379b993a50ef7c0b46bc3777f3c419a89f2cc876eb8872ba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34953.exe

Filesize
468KB

MD5
5c0b22078b6e12424a8531a12a14694c

SHA1
9e11a1ba2d05f9c467cfa114df54293f0e1b96f3

SHA256
76e0f57e2b93bf7adb708657145808308727e73ad13ab07288d5edd358996464

SHA512
b480a8cc70d3b7d0e79350ef2457f63723ab1d165b855bf2e3d91a414a9fa8727b111dc90be3e35dbf79ebc0f5e3a46f032072d55448b81c75386d142441d81c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe

Filesize
468KB

MD5
3c34805de0b405fc6e7b85dab84d5258

SHA1
d484251ab286ba7720a77e313731587fb453af41

SHA256
680c6fd81c7f2fdcb813d0a9e7c16cbaaa3b18047ab9c957c1ae6c2718ab5fba

SHA512
65594448f02af638f20c56568cead89365a342ae11c887c2465a2ee08d4c2e9f8a5429bfcdc70f263d1242307c657ff9d99de0b96701962b284818889940b270

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe

Filesize
468KB

MD5
51b16389a5ddaf2263fca4d72293df20

SHA1
3b385664ce65e27090649f091249e473f9978617

SHA256
47c3e847269993e6b15816c9b0df1cbb3bcaa84c125073a49f5927d7ca30362e

SHA512
01873b1111b44315115e25aa83f1a04bff3d0640ea115cdcda960ed60a773e1aa75219cb5764c8cb1634d0ed4204b1d5abc5f0af21bf297db644a24b82684223

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46452.exe

Filesize
468KB

MD5
9d7fe4a972b10b8d348f3bf1feaa7bde

SHA1
0c37f9f39fd2ed222dfdb28ee61c31cc8c4dce20

SHA256
3b15f103f5132947449bddb671accb7a3e126fa6f3be0115fa7feb77985c0d0f

SHA512
392e79cbaaf1b70c8f986ad334102871916188984e96e82cd1767ac1a9a982cf1739aec7835845085f599a8255b15346f6dc2e47d30705a0397ec5fdbe75d412

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53788.exe

Filesize
468KB

MD5
b0aed617571b84632d402c6654068ad5

SHA1
e246145f80de642ab7be0b9f7879a386a2bec430

SHA256
e613744736a9d5f90e8b37c60a80d077651942e2fb919129b54554649fff4b3b

SHA512
daaf0684e6b89701bcffda74fc2fdb16ccd21d5ef4c81697219dc85b1aa2e8d810193a4532f385beba914aa04f4f2b2683868c4bffb52ace80bd63337307b499

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe

Filesize
468KB

MD5
e8e6539aeab7dc920b40557d633ba091

SHA1
3f99e1f7264c291972b7c43f2c9d1bc902a04cfc

SHA256
c5c58153d118705adfc93d4c12bcda9e3ee94faa9e26c6e12122ea9aaee9df33

SHA512
84a53e5a1570530d52e342a38f6be978ddd2391eed7c670c3941a03f423bda36defa9f7c7a2c19206cf744dfb84ae4631817772168b999e577ecba7db07fb493

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60905.exe

Filesize
468KB

MD5
df03679e4c39e76aef0daea9cfb29184

SHA1
2129aa74bb60565ed050469d6edbb9a8bb2f85cc

SHA256
2ea34e0d58d87c3d03dfa3654142207d867a0c98c3d2d3dc4cddd3a41a69d7b2

SHA512
5363c4babb269a06c8f2c4d122c5a7957a8af49551bc87d3addac0c9e2286c6ada8216244739b6eaae0f80dd004412f435f8ec75e08b8ed94667190b426b2183

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe

Filesize
468KB

MD5
20ceb912ce7ffc51c998b108baa3d47a

SHA1
4e98d9ac9e28d7b256cc0040f64e0ccfcfd83431

SHA256
072f61b824453f7f52cbd62e4d86b2870eaf53520f4fce2b3a910831b96192b8

SHA512
bad4e3a4f4566e73fb31dfe866e7bfae031a7ed1d8de40ae8d356791ee619d9da813c00b9f1baeb5c2cea51f8cac6997119833ffd944ab3b0a994aa6903f7fed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe

Filesize
468KB

MD5
28689313560da7de2d4df2ac02e82740

SHA1
8adb3dd5d28cf2e3b332e731411f14a7e6f193b0

SHA256
78595833d6aed0ec5cf7002e044bf9c68ed39d427ffebcb68d6e74c0a60d5e6d

SHA512
3ded8372bd2dadd75fcbe93e9696fc6d60a7af3d4172994554ec16b33313a26da0eb6ad42597619daef7bd91515f06999d0bfc1215757db1a7adca53f6823f4a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe

Filesize
468KB

MD5
ab97a6062b61b5854d459f52be8823ec

SHA1
4a3a1fa053a04aae6d8c90276e384451861488a8

SHA256
e8c636420fdacc7e12a7ecf65ce0fac21c7a4013d81bfb57e5df1460abcd24aa

SHA512
47582c59ab4e7c141a8993301e205b77155cc64c075729af73dd174b7efb364c217a675830327c4a594b2dce88d4fb20eb22de463f95d44a08d4da5779f43989

Download Submit
memory/476-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-147-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/632-6-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/632-32-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/632-292-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/632-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-65-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/632-293-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/692-216-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/692-217-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/692-360-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/692-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/692-359-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/968-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-254-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/968-258-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/1016-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1028-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1028-263-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1064-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1108-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1252-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-373-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/1356-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-371-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/1380-389-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1380-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1520-328-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/1540-288-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/1540-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-347-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1736-200-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/1736-348-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1736-92-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/1736-202-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1736-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-447-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/1808-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-448-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2200-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-395-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2212-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-396-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2268-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-415-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/2312-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-239-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2312-235-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2348-42-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2348-268-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2348-269-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2348-24-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-172-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2348-166-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2348-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-350-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2648-186-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2648-195-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2664-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-229-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2732-123-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2732-228-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2756-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-279-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2796-277-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2808-349-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/2808-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2820-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-446-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2836-302-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2836-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-160-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2844-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-278-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/2860-122-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/2860-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-273-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/2876-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-136-0x0000000003290000-0x0000000003305000-memory.dmp

Filesize
468KB

Download
memory/2876-432-0x0000000003490000-0x0000000003505000-memory.dmp

Filesize
468KB

Download
memory/2904-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3032-413-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/3032-249-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/3032-248-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/3032-22-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/3032-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download