fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13

Analysis

max time kernel
147s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
Size

468KB
MD5

84edee886869f5d45a2b9c706d75309e
SHA1

19a1b9f4933df399e2011f9b4e5e0dbf972ae023
SHA256

fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13
SHA512

8a96bb2f93edb2148b9e5ff58a84f7c3d29188ab7eb0d06cec15a78cbbe597bb9cb3e737def99d9f0c1f97265eb6a8925c06b0e933093a1149d924ce07348839
SSDEEP

3072:ToA1ogYnI05ptbYnPz4jef8/ECxvPgpxcmHe6Vs/8YX7iM9ukQlT:ToCom8ptkPEjefWcYn8YLn9uk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2680	Unicorn-3565.exe
2708	Unicorn-43244.exe
2908	Unicorn-39195.exe
2576	Unicorn-14079.exe
2784	Unicorn-26502.exe
2600	Unicorn-45299.exe
2220	Unicorn-55505.exe
2612	Unicorn-4557.exe
2880	Unicorn-68.exe
864	Unicorn-22622.exe
1708	Unicorn-54417.exe
2296	Unicorn-2372.exe
324	Unicorn-16107.exe
556	Unicorn-21972.exe
1040	Unicorn-22238.exe
2404	Unicorn-20261.exe
2180	Unicorn-17992.exe
2196	Unicorn-10372.exe
1776	Unicorn-20770.exe
1368	Unicorn-12619.exe
2316	Unicorn-27922.exe
848	Unicorn-31068.exe
2484	Unicorn-30995.exe
1544	Unicorn-63932.exe
2084	Unicorn-43490.exe
688	Unicorn-23676.exe
2896	Unicorn-29807.exe
2464	Unicorn-29807.exe
2472	Unicorn-21561.exe
2068	Unicorn-10626.exe
2440	Unicorn-8888.exe
2144	Unicorn-26521.exe
892	Unicorn-14591.exe
1792	Unicorn-39873.exe
1608	Unicorn-62832.exe
2752	Unicorn-29283.exe
2704	Unicorn-58042.exe
2712	Unicorn-28899.exe
2736	Unicorn-28634.exe
2688	Unicorn-28934.exe
2332	Unicorn-31587.exe
2664	Unicorn-24880.exe
2560	Unicorn-14866.exe
1096	Unicorn-44010.exe
2788	Unicorn-27097.exe
2444	Unicorn-14098.exe
1504	Unicorn-40186.exe
336	Unicorn-20320.exe
3020	Unicorn-56330.exe
2004	Unicorn-47400.exe
640	Unicorn-6553.exe
1432	Unicorn-46816.exe
2792	Unicorn-1571.exe
2244	Unicorn-55562.exe
2156	Unicorn-40388.exe
2840	Unicorn-57181.exe
2400	Unicorn-17610.exe
832	Unicorn-23741.exe
1072	Unicorn-23741.exe
1140	Unicorn-16842.exe
2512	Unicorn-3107.exe
1540	Unicorn-35988.exe
1732	Unicorn-47534.exe
612	Unicorn-21406.exe

Loads dropped DLL 64 IoCs

pid	Process
2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
2680	Unicorn-3565.exe
2680	Unicorn-3565.exe
2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
2708	Unicorn-43244.exe
2708	Unicorn-43244.exe
2680	Unicorn-3565.exe
2680	Unicorn-3565.exe
2908	Unicorn-39195.exe
2908	Unicorn-39195.exe
2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
2600	Unicorn-45299.exe
2600	Unicorn-45299.exe
2908	Unicorn-39195.exe
2908	Unicorn-39195.exe
2220	Unicorn-55505.exe
2576	Unicorn-14079.exe
2220	Unicorn-55505.exe
2576	Unicorn-14079.exe
2708	Unicorn-43244.exe
2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
2680	Unicorn-3565.exe
2784	Unicorn-26502.exe
2708	Unicorn-43244.exe
2784	Unicorn-26502.exe
2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
2680	Unicorn-3565.exe
2612	Unicorn-4557.exe
2612	Unicorn-4557.exe
2600	Unicorn-45299.exe
2600	Unicorn-45299.exe
2880	Unicorn-68.exe
2880	Unicorn-68.exe
2908	Unicorn-39195.exe
2908	Unicorn-39195.exe
864	Unicorn-22622.exe
864	Unicorn-22622.exe
2220	Unicorn-55505.exe
2220	Unicorn-55505.exe
324	Unicorn-16107.exe
324	Unicorn-16107.exe
2680	Unicorn-3565.exe
2680	Unicorn-3565.exe
1708	Unicorn-54417.exe
1708	Unicorn-54417.exe
2576	Unicorn-14079.exe
2576	Unicorn-14079.exe
2708	Unicorn-43244.exe
2708	Unicorn-43244.exe
1040	Unicorn-22238.exe
556	Unicorn-21972.exe
1040	Unicorn-22238.exe
556	Unicorn-21972.exe
2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
2784	Unicorn-26502.exe
2784	Unicorn-26502.exe
2404	Unicorn-20261.exe
2404	Unicorn-20261.exe
2612	Unicorn-4557.exe
2180	Unicorn-17992.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2716	2752	WerFault.exe	65
3496	304	WerFault.exe	130
4192	2632	WerFault.exe	127

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24675.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
2680	Unicorn-3565.exe
2708	Unicorn-43244.exe
2908	Unicorn-39195.exe
2600	Unicorn-45299.exe
2576	Unicorn-14079.exe
2220	Unicorn-55505.exe
2784	Unicorn-26502.exe
2612	Unicorn-4557.exe
2880	Unicorn-68.exe
864	Unicorn-22622.exe
2296	Unicorn-2372.exe
324	Unicorn-16107.exe
556	Unicorn-21972.exe
1708	Unicorn-54417.exe
1040	Unicorn-22238.exe
2404	Unicorn-20261.exe
2180	Unicorn-17992.exe
2196	Unicorn-10372.exe
1776	Unicorn-20770.exe
1368	Unicorn-12619.exe
2316	Unicorn-27922.exe
848	Unicorn-31068.exe
2484	Unicorn-30995.exe
1544	Unicorn-63932.exe
2084	Unicorn-43490.exe
2896	Unicorn-29807.exe
688	Unicorn-23676.exe
2464	Unicorn-29807.exe
2472	Unicorn-21561.exe
2068	Unicorn-10626.exe
2440	Unicorn-8888.exe
2144	Unicorn-26521.exe
892	Unicorn-14591.exe
1792	Unicorn-39873.exe
1608	Unicorn-62832.exe
2712	Unicorn-28899.exe
2704	Unicorn-58042.exe
2752	Unicorn-29283.exe
2688	Unicorn-28934.exe
2332	Unicorn-31587.exe
2736	Unicorn-28634.exe
2664	Unicorn-24880.exe
2560	Unicorn-14866.exe
1096	Unicorn-44010.exe
2788	Unicorn-27097.exe
2444	Unicorn-14098.exe
336	Unicorn-20320.exe
1504	Unicorn-40186.exe
2004	Unicorn-47400.exe
3020	Unicorn-56330.exe
640	Unicorn-6553.exe
1432	Unicorn-46816.exe
2244	Unicorn-55562.exe
2792	Unicorn-1571.exe
2156	Unicorn-40388.exe
2840	Unicorn-57181.exe
832	Unicorn-23741.exe
2400	Unicorn-17610.exe
1072	Unicorn-23741.exe
1140	Unicorn-16842.exe
2512	Unicorn-3107.exe
1540	Unicorn-35988.exe
1732	Unicorn-47534.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2680	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	30
PID 2996 wrote to memory of 2680	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	30
PID 2996 wrote to memory of 2680	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	30
PID 2996 wrote to memory of 2680	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	30
PID 2680 wrote to memory of 2708	2680	Unicorn-3565.exe	31
PID 2680 wrote to memory of 2708	2680	Unicorn-3565.exe	31
PID 2680 wrote to memory of 2708	2680	Unicorn-3565.exe	31
PID 2680 wrote to memory of 2708	2680	Unicorn-3565.exe	31
PID 2996 wrote to memory of 2908	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	32
PID 2996 wrote to memory of 2908	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	32
PID 2996 wrote to memory of 2908	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	32
PID 2996 wrote to memory of 2908	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	32
PID 2708 wrote to memory of 2576	2708	Unicorn-43244.exe	33
PID 2708 wrote to memory of 2576	2708	Unicorn-43244.exe	33
PID 2708 wrote to memory of 2576	2708	Unicorn-43244.exe	33
PID 2708 wrote to memory of 2576	2708	Unicorn-43244.exe	33
PID 2680 wrote to memory of 2784	2680	Unicorn-3565.exe	34
PID 2680 wrote to memory of 2784	2680	Unicorn-3565.exe	34
PID 2680 wrote to memory of 2784	2680	Unicorn-3565.exe	34
PID 2680 wrote to memory of 2784	2680	Unicorn-3565.exe	34
PID 2908 wrote to memory of 2600	2908	Unicorn-39195.exe	35
PID 2908 wrote to memory of 2600	2908	Unicorn-39195.exe	35
PID 2908 wrote to memory of 2600	2908	Unicorn-39195.exe	35
PID 2908 wrote to memory of 2600	2908	Unicorn-39195.exe	35
PID 2996 wrote to memory of 2220	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	36
PID 2996 wrote to memory of 2220	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	36
PID 2996 wrote to memory of 2220	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	36
PID 2996 wrote to memory of 2220	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	36
PID 2600 wrote to memory of 2612	2600	Unicorn-45299.exe	37
PID 2600 wrote to memory of 2612	2600	Unicorn-45299.exe	37
PID 2600 wrote to memory of 2612	2600	Unicorn-45299.exe	37
PID 2600 wrote to memory of 2612	2600	Unicorn-45299.exe	37
PID 2908 wrote to memory of 2880	2908	Unicorn-39195.exe	38
PID 2908 wrote to memory of 2880	2908	Unicorn-39195.exe	38
PID 2908 wrote to memory of 2880	2908	Unicorn-39195.exe	38
PID 2908 wrote to memory of 2880	2908	Unicorn-39195.exe	38
PID 2220 wrote to memory of 864	2220	Unicorn-55505.exe	39
PID 2220 wrote to memory of 864	2220	Unicorn-55505.exe	39
PID 2220 wrote to memory of 864	2220	Unicorn-55505.exe	39
PID 2220 wrote to memory of 864	2220	Unicorn-55505.exe	39
PID 2576 wrote to memory of 1708	2576	Unicorn-14079.exe	40
PID 2576 wrote to memory of 1708	2576	Unicorn-14079.exe	40
PID 2576 wrote to memory of 1708	2576	Unicorn-14079.exe	40
PID 2576 wrote to memory of 1708	2576	Unicorn-14079.exe	40
PID 2708 wrote to memory of 2296	2708	Unicorn-43244.exe	41
PID 2708 wrote to memory of 2296	2708	Unicorn-43244.exe	41
PID 2708 wrote to memory of 2296	2708	Unicorn-43244.exe	41
PID 2708 wrote to memory of 2296	2708	Unicorn-43244.exe	41
PID 2784 wrote to memory of 1040	2784	Unicorn-26502.exe	44
PID 2996 wrote to memory of 556	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	42
PID 2996 wrote to memory of 556	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	42
PID 2996 wrote to memory of 556	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	42
PID 2996 wrote to memory of 556	2996	fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe	42
PID 2784 wrote to memory of 1040	2784	Unicorn-26502.exe	44
PID 2784 wrote to memory of 1040	2784	Unicorn-26502.exe	44
PID 2784 wrote to memory of 1040	2784	Unicorn-26502.exe	44
PID 2680 wrote to memory of 324	2680	Unicorn-3565.exe	43
PID 2680 wrote to memory of 324	2680	Unicorn-3565.exe	43
PID 2680 wrote to memory of 324	2680	Unicorn-3565.exe	43
PID 2680 wrote to memory of 324	2680	Unicorn-3565.exe	43
PID 2612 wrote to memory of 2404	2612	Unicorn-4557.exe	45
PID 2612 wrote to memory of 2404	2612	Unicorn-4557.exe	45
PID 2612 wrote to memory of 2404	2612	Unicorn-4557.exe	45
PID 2612 wrote to memory of 2404	2612	Unicorn-4557.exe	45

C:\Users\Admin\AppData\Local\Temp\fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe
"C:\Users\Admin\AppData\Local\Temp\fa7f4cc8532f0f336469bf9b40557f62d67dcefdd812add4ce0f682c49387e13.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14079.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        8⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-366.exe
        9⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        9⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        9⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        9⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        9⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
        9⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61606.exe
        8⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        8⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        8⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        8⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        7⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-366.exe
        8⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        8⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        8⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3854.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        8⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58429.exe
        7⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exe
        7⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        7⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5161.exe
        8⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53660.exe
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
        8⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        8⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
        7⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8908.exe
        6⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        7⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        6⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        6⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57181.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        7⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20908.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        7⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
        6⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 220
        7⤵
        Program crash
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        6⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        6⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1175.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        7⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        6⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        6⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63035.exe
        5⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25787.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        5⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        5⤵
        
        PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        6⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61010.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16471.exe
        7⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        6⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46102.exe
        6⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32588.exe
        6⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        6⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        6⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23433.exe
        5⤵
        
        PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
        5⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60090.exe
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        5⤵
        
        PID:9128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16523.exe
        6⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        7⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20652.exe
        8⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        8⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        8⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
        7⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        7⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        7⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        6⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
        7⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7505.exe
        7⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        6⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15955.exe
        5⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe
        6⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        6⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51643.exe
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        6⤵
        
        PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        5⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        5⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        5⤵
        
        PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
        5⤵
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
        6⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        6⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        6⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2096.exe
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        5⤵
        
        PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
        5⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        5⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        5⤵
        
        PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17272.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48121.exe
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49157.exe
      4⤵
      PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12998.exe
      4⤵
      PID:8860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26502.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22238.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29807.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53848.exe
        7⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        7⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18331.exe
        6⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        6⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        6⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53660.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
        7⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56417.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50291.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55812.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38547.exe
        6⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        6⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
        6⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
        5⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61010.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        6⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7505.exe
        6⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        5⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        5⤵
        
        PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        5⤵
        
        PID:8904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38230.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        7⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33466.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32633.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        7⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        6⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-153.exe
        6⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        6⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        5⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2563.exe
        5⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        5⤵
        
        PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
        5⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        5⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        5⤵
        
        PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47550.exe
      4⤵
      PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe
      4⤵
      PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
      4⤵
      PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
      4⤵
      PID:7900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31068.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        6⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60525.exe
        8⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        8⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        7⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        6⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        6⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        5⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61010.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54268.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        6⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
        5⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        5⤵
        
        PID:8372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        5⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
        6⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        6⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64606.exe
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        6⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63687.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10264.exe
        5⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        5⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        5⤵
        
        PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
      4⤵
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        5⤵
        
        PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25787.exe
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3145.exe
      4⤵
      PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
      4⤵
      PID:7856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30995.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
        5⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        6⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35846.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        6⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        5⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        5⤵
        
        PID:7824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exe
      4⤵
      PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4033.exe
        5⤵
        
        PID:8340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33066.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
      4⤵
      PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
      4⤵
      PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
      4⤵
      PID:8052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47400.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
      4⤵
      PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25600.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
      4⤵
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
      4⤵
      PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
      4⤵
      PID:7680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
    3⤵
    PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17656.exe
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exe
    3⤵
    PID:6204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
    3⤵
    PID:7428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23171.exe
    3⤵
    PID:8072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20261.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8888.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        8⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        8⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        8⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        7⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47534.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        7⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        7⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4152.exe
        6⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        6⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
        6⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26521.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        6⤵
        Executes dropped EXE
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7693.exe
        7⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46846.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        7⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        7⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        6⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        6⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24307.exe
        6⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44165.exe
        5⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65028.exe
        6⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4598.exe
        7⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        6⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
        6⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21434.exe
        5⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        6⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37506.exe
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50104.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        5⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        5⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        5⤵
        
        PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14591.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
        7⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        7⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
        6⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        6⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40516.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35748.exe
        5⤵
        
        PID:268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        6⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2563.exe
        5⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        5⤵
        
        PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
        6⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44198.exe
        6⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        6⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        6⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        5⤵
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33723.exe
        5⤵
        
        PID:8380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49890.exe
      4⤵
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        5⤵
        
        PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        5⤵
        
        PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27974.exe
      4⤵
      PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
      4⤵
      PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe
      4⤵
      PID:7348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3450.exe
        6⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53660.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
        7⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        6⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
        5⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
        6⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        7⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        6⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        6⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exe
        6⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24689.exe
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10734.exe
        6⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28065.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
        6⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        6⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-101.exe
        5⤵
        
        PID:676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31061.exe
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54712.exe
        5⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
        5⤵
        
        PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58042.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
        6⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        6⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46554.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60726.exe
        5⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
        5⤵
        
        PID:8264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29407.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46626.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
        5⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        5⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23450.exe
        5⤵
        
        PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52080.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
      4⤵
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe
      4⤵
      PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
      4⤵
      PID:7196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
      4⤵
      PID:7384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29283.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 220
        5⤵
        Program crash
        
        PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62303.exe
      4⤵
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18208.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        5⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        5⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
        5⤵
        
        PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44190.exe
      4⤵
      PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
      4⤵
      PID:7496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
      4⤵
      PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55505.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56312.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36403.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        6⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        6⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        5⤵
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        5⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
      4⤵
      PID:304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 220
        5⤵
        Program crash
        
        PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
      4⤵
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
      4⤵
      PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      4⤵
      PID:8928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65023.exe
    3⤵
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
      4⤵
      PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
      4⤵
      PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
      4⤵
      PID:7668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28159.exe
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe
    3⤵
    PID:4124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
    3⤵
    PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
    3⤵
    PID:6836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
    3⤵
    PID:7876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55505.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55505.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12619.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28899.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8416.exe
        6⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        7⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62639.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        6⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62194.exe
        5⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-153.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        6⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        5⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        5⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        5⤵
        
        PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28934.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6048.exe
        6⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        6⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
        6⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        6⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30397.exe
        6⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59314.exe
        6⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        5⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
        5⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18985.exe
        5⤵
        
        PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49951.exe
      4⤵
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
        5⤵
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        5⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        5⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        5⤵
        
        PID:8696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49219.exe
      4⤵
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38809.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
      4⤵
      PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11863.exe
      4⤵
      PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
      4⤵
      PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46322.exe
      4⤵
      PID:7956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31587.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6221.exe
        5⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
        6⤵
        
        PID:352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24145.exe
        6⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
        6⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        5⤵
        
        PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        5⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8920.exe
        5⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50440.exe
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        5⤵
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        5⤵
        
        PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        5⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45466.exe
      4⤵
      PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47474.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
      4⤵
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
      4⤵
      PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39751.exe
      4⤵
      PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3225.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24880.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55474.exe
      4⤵
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61010.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        5⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7505.exe
        5⤵
        
        PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exe
      4⤵
      PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24138.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
      4⤵
      PID:8228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54249.exe
    3⤵
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33330.exe
      4⤵
      PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
    3⤵
    PID:4100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
    3⤵
    PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16642.exe
    3⤵
    PID:7472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
    3⤵
    PID:7560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29807.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        5⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        6⤵
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42978.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        6⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        5⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46554.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3615.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8806.exe
        5⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43681.exe
        5⤵
        
        PID:8256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
      4⤵
      PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        5⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        5⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
      4⤵
      PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
      4⤵
      PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
      4⤵
      PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
      4⤵
      PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
      4⤵
      PID:8816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1571.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
      4⤵
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11660.exe
        5⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19792.exe
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        6⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34705.exe
        5⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe
        5⤵
        
        PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60814.exe
      4⤵
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58182.exe
        5⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        5⤵
        
        PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
      4⤵
      PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
      4⤵
      PID:7524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15955.exe
    3⤵
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55060.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
      4⤵
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
      4⤵
      PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
      4⤵
      PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      4⤵
      PID:8984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
    3⤵
    PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
    3⤵
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
    3⤵
    PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
    3⤵
    PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
      4⤵
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        5⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        5⤵
        
        PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe
      4⤵
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
      4⤵
      PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      4⤵
      PID:9040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
    3⤵
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14843.exe
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
      4⤵
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25111.exe
      4⤵
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
      4⤵
      PID:8452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
    3⤵
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
    3⤵
    PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17218.exe
    3⤵
    PID:8100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
    3⤵
    PID:8944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8416.exe
    3⤵
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
      4⤵
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        5⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44709.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32891.exe
        5⤵
        
        PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28608.exe
      4⤵
      PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
      4⤵
      PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
      4⤵
      PID:8912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
    3⤵
    PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
      4⤵
      PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30397.exe
      4⤵
      PID:7636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59698.exe
      4⤵
      PID:8220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
    3⤵
    PID:3556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
    3⤵
    PID:4572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
    3⤵
    PID:5156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
    3⤵
    PID:7784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9383.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9383.exe
  2⤵
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10553.exe
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20411.exe
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
    3⤵
    PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
    3⤵
    PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-153.exe
    3⤵
    PID:8152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
    3⤵
    PID:8476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
  2⤵
  PID:3088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
  2⤵
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe
  2⤵
  PID:5308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21610.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21610.exe
  2⤵
  PID:6752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-20261.exe

Filesize
468KB

MD5
bf742139d65135e33127a2a67f730962

SHA1
0f7216195284cc0cb0004809be562b4665edc405

SHA256
f459ea2682f44887f8ca893d9cc3276cba5378ee80f45e1c659a0128eaf7c89e

SHA512
a4e8a10b3f8c6bd8603c05d1a7b9e7ad37f5f32d60b84bea0af7c5e6578b4a35d199a6339ce542401eda99c59e37ad2055edce4d2bf27a314e03847d62cb2897

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe

Filesize
468KB

MD5
7ad2f53ad9cf68230dbbee5f6d76682a

SHA1
40f797069f35f81387b93ad9ec3571a6eaba9294

SHA256
affc14f72c988c608d3185c53828bed96594e05634f0fb7ad98a5f5c8e50c64c

SHA512
97a8e190575df1e0acf7ff73b89def5fbc319250134165d9c25c7e0bbd968e013628d3e50224303ce90a73ee2c696c58c50ae776575a7b0f559a76bb657ece1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe

Filesize
468KB

MD5
f140e9caa27f6a46e4ee2ca41ba6f705

SHA1
2a7ba46834af7e466da0cc60b0e84df7afe8758a

SHA256
b60c294bb8bf0fd1b128d3cdabd42f5a79f8f132d037166ec65b2a1f3f519075

SHA512
d85b22cca9b43a404b7ac40f33b6de7b851632b07010c6427515d588c38acbb32d404ed37e03a391485f5a4f39c5c34f942ea3d19af7d3e4b80eccf75189fe99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe

Filesize
468KB

MD5
1298a537a4ca9d5d7f18ec563d881ed8

SHA1
2c6845dabed1a9ea3a943c4370ac6a35de3da5ec

SHA256
c973c899f846d560f584b44f8ba7d16796ab3b97262a6ce5559382efc690a9ce

SHA512
9d47c332343794fa387b83934bec20e499451e53602a30f791ccec9e834c6cdf9e2960149a4f4d9ed468b423215876193bdbdcab42be5e8e0faa4d39995b1fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe

Filesize
468KB

MD5
f17484ae34440f7124db5d2868c4301f

SHA1
1bd570d9fd989d7fdc259d14447cb00d639d63cb

SHA256
89c7bf92d7e6844918fba474fbf256e0cd33d82330db53bfa000a93a72529c93

SHA512
9a27382365758e7340f962aaf59dfee486966ef0b1fa9c5e2b4162d4b43873a641df425ca640be6a064fd525a7bd3c79dc82605896480fe9318bed1db3f56a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe

Filesize
468KB

MD5
f9c9e5a6b0115179f86151e277159081

SHA1
68545a0008fbc3d517b5789b153617892eb6e5c0

SHA256
6584a811c1621e14752538ea6e6b3550fb6e728f34a94f7a5279206d6b104aed

SHA512
6a1bc4e45b086da9afb7e4b66dc850cf3147303979abd9294819509534ea1109e69a9098444479b5b69a08d29ec5075c795fea9680fc4986d99684a61dc1389d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe

Filesize
468KB

MD5
b9f38878f07e4960fc9cc6a918ecd92f

SHA1
ff6100b3ec12029707fb2e1707542b9ec3ec1156

SHA256
cb86cc0dbf57f4c9675075be56f0593663324847408db4708bb695a40c0e6560

SHA512
51090c561f974748661edae67c4178c7e49f2bb3f753032cc03a8ce140d9a0d8b39d0f7d2706b877363811a2380c81249eb27995779be1c3c8b3877bf58f614d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe

Filesize
468KB

MD5
46901328c791a044a1abe727e73817c9

SHA1
3c8ae156f8dbc872242daf7605c9c00e2a18e9fe

SHA256
bd7e9273c037854040859cfc2bb81d697c4c27a21f36e8cfad173831fd8ed3a8

SHA512
cc523e92a4d82e5654e657e566a513e5d5baec3a1ea8559c606ae72a05f96a5c3dd30b46d11b9b3d7f877526591094b24918b0827383e36fbf2f3a5fc01b7054

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14079.exe

Filesize
468KB

MD5
d689030250a281cead575bb075738415

SHA1
78d30f90c9bcf43a543457efeff22b730f1d49b2

SHA256
8e8f4c67853ee4da606005c5d48b8094fdf4045b62129525d155f5c87778e7b5

SHA512
7699bab8fa096781bb35cbe752e2f075c653b4c346f5a9bb94a98f4b7482a8a53397b54409532612318f42293777a5b3d833f4e3e512ffe137babe9d5565f50d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe

Filesize
468KB

MD5
4be71e9c873828f8ad5020ff2633ab3e

SHA1
8cbe843903e6d70de6f0d02288c133ac75765ef7

SHA256
2aa80c6b81b64942ee2b01f8ecb26e7424f0d52d736165a078e87fa97cc3662e

SHA512
a652c425794763d5c65b17409d8e74dd303e72a1b098bb5df5b049154f98bbbe7fa3f610703e73e18970012000c87e65294c19a15395cf5b1a96390eb6a583c8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe

Filesize
468KB

MD5
72281e1dd61e356179e424281b30fa69

SHA1
529c1dda960612cf7746cb9c155dd5386683bb96

SHA256
b72c5d4f186a81fd4a167bff3b5c6df9e3047d57a33cd7cdce7fac09fb498241

SHA512
3c7c94c1a25260bc196bf10fabc0c716a6e1a647086da153b31c928bca47c8672fb5b530682538d9aa40f4d933cc6757444073bd1e69146001a623f7d4b62eca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20770.exe

Filesize
468KB

MD5
0759983b1b7e3cb7a0049dcfa34cda8e

SHA1
1a5892d9db3584f094ec9ccdfe9a9af16ee0b424

SHA256
ed672ccaffbe49900ded1b6b4b9af5d551753429a98aa7ea1d55c53eb6086991

SHA512
2a853c9e64fcb6ab886abfe6a3109955ad8211c67ca0767598a58102bc5279ad37d1025c7a7834661568e22bd2708d6025c02032eb99dfffe1cf77cb4cce7ba3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe

Filesize
468KB

MD5
9c3b45e06ee67c0e553c6406d66f6781

SHA1
43e254403fe81a29f609c8eaf04a110d2a3b5db4

SHA256
9dc68b12ae434621cd9fa125a49ebaa40df04500844bd8546a9ace55180bc212

SHA512
b4bc4cd98cafe7c3c4b734eda0a0b9105570c714832629e64e1a114d9f49b951722442b8781c78be23117b0efc0da27eab731400c2d7bc950bd0593ebd59b1af

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22238.exe

Filesize
468KB

MD5
398a7eb537ceb510d6194975261b4578

SHA1
ebf7b5298a048b0e6c4240ebc5fb54be7ba71d25

SHA256
9a6c09686a307ac6a972ff7af8a631eb2deacc82e252f4164bab0f9eadd7beb1

SHA512
eb83f7c3dfdeeb5ff57935b3f78bf2b49063a2613728fc1e7e1cb88cbc75f1d32b9c6d3c1c6b6f39821f8d7ec5baf7fab7d610caf67b7b59d19755b1c2ee72f5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe

Filesize
468KB

MD5
0ee8c3df481b8723e19d3e330c322420

SHA1
f4de2c22da8a85b442ab19edbefbfbfe00cdffc9

SHA256
2cd3ae7c4891291e44075ded2ef198f702cbb957b16f7e051aaa5e0404df3544

SHA512
a19e21b10572e53f00eefe56aeb9f7910731738ef163d5e016bf22e89d8cb1e89d1abf76be8a792c8124d6924ed68ad4bfbfd0f26a33e9a6c26e2e621d55bbf9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe

Filesize
468KB

MD5
dbbea1f3c32488a9fe33fd711ac13136

SHA1
31bec10eaa19414bcb61a9ec1d0a9b131184cf33

SHA256
f9214e3ddb572c207dd672585a78c5303c2f8a0275f760fbc27345e880ba2d38

SHA512
3205bdc9c2658db835e7ebff5f787d47ee0b323ae28e504cefaf3f4a7a54a3760d9b7ce2e0bff525de3cacc24542303c9152d738e66529bd74755a291668140a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26502.exe

Filesize
468KB

MD5
b5c1f19e4ba843696346fd7dc75e3282

SHA1
255ddd3c8c3cefcaa10df41934d54349e77abd7f

SHA256
119cc244653d297cd75fb2cf276a7a07336cf5dd6be839ca6cadb944f569cde6

SHA512
68965739b7fc7868197d173addc54e66c4c239b06318284d642648523a9194dd6b387f31d1b61fa95c4091d79059dd76d282c8e078473a5c722eddd1305e15b4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe

Filesize
468KB

MD5
e079bb68ed9c740b3ee2070a7c4531b7

SHA1
f551c4efffa21edbd125c31e165c0b630317449a

SHA256
4371c218acc2c9a6be6b85524ff755dbd4f28d32bd8e824dd4edd9c3d1966f5d

SHA512
d0a062394e13e41f25b92278a5d516a3a8bd3b8568432c84911c6c11a025c4a861cfecd4d5741c26f19b972bc6e65231d0b1f0f300cf2510a0180f5d90b8aeea

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe

Filesize
468KB

MD5
23759e87834714c0fbd0c0a7b39a5b80

SHA1
b666f906232fd86afd4704c6a8cb546420a29531

SHA256
bad83533e07d4cd5f21130aa5cd7a138f310a3cb969ef0cfbc01e42de00eea99

SHA512
16c766a87dc7f525b11b39c5f5175a571d244153fe33f878cca4044bb1cc630cb42474cf6cc542c6ab12fbf1548a635c5447815d7541a9ecab14f96cbea41ad7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe

Filesize
468KB

MD5
97df7757ae10a88aa13554bc584304a0

SHA1
1adb3e68a340badf929e286cf9cce0d1209e106c

SHA256
97b1e5858f03a44ad625c470922f83302625983decf06d899db0712a090a02bf

SHA512
6a4da5df18c1a4223bb0db822f0c1e184fe6822dc088b6a48d2994d66a8bc93bcbb17e03a528554b75b1c0bd1ade0b3c9929706cdba4a07beea2d007697c710d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55505.exe

Filesize
468KB

MD5
1783cfdc903119a34cb1ba11d340e8d0

SHA1
f3dbcd4839f3ae29621a9c78b35e604968d14693

SHA256
1d3cb2752c22b89d5e9faeead564882492dc2b40942376cceb1fe1d7780351f1

SHA512
13c97c11339b9d4e586cc205f7121d5cd05d670215f810153cacd0ca65c2254746690c603b7006c97889a78f34910e1f6010c7d0cc1f4bda3a5ca9fe68fbc388

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-68.exe

Filesize
468KB

MD5
b663f1b98db0f6992349d3b5a0e8956b

SHA1
8a0f2607324599a73c47140628d476ab692cf8f0

SHA256
e3787804b87be33bef70308d65d8804195fec5129e1c31d77de743b701111ec9

SHA512
ae0af9ccfdb556f3353bf5505ce57b648aa616a010debb1cc816d49937a56fdb362a523315ee6cdbc2446c4a4e28ce0e8afa8458538a78244c3242b47b78b9f1

Download Submit