1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
Size

468KB
MD5

ceb77ab96a896585d22b175c30a5eed0
SHA1

e08508e3888afca9bff36e3990bf677e2e3faec7
SHA256

1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611
SHA512

cee2567bee754ee04a6a2c76f08459b7fc0b2982d56b074b43f2dc20af5247063b2d218a810a70dfdaa25b2a724afd0a9e76d3ad2b510fb03cd89acdccbfa898
SSDEEP

3072:WudSogdEIc5AHbY9zfjcff8w3aJBHpnqJEHCgdS+uZDLyeLD+AfT:WuUoE0AHSzrcffOBYSuZHtLD+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2684	Unicorn-38063.exe
2696	Unicorn-2959.exe
2688	Unicorn-12751.exe
2892	Unicorn-4241.exe
2540	Unicorn-58081.exe
2656	Unicorn-12409.exe
3048	Unicorn-39144.exe
1476	Unicorn-26639.exe
3064	Unicorn-53373.exe
2428	Unicorn-32607.exe
1904	Unicorn-32607.exe
2452	Unicorn-40775.exe
2792	Unicorn-4765.exe
1248	Unicorn-24366.exe
892	Unicorn-13125.exe
1900	Unicorn-39161.exe
2960	Unicorn-46239.exe
2460	Unicorn-8735.exe
2512	Unicorn-38262.exe
2208	Unicorn-8927.exe
632	Unicorn-41792.exe
2168	Unicorn-41527.exe
2060	Unicorn-46623.exe
1908	Unicorn-17288.exe
1960	Unicorn-44022.exe
1600	Unicorn-50152.exe
1520	Unicorn-58512.exe
1308	Unicorn-6157.exe
2976	Unicorn-19726.exe
604	Unicorn-39592.exe
3000	Unicorn-789.exe
2256	Unicorn-28466.exe
1728	Unicorn-624.exe
2304	Unicorn-60562.exe
1548	Unicorn-5423.exe
2748	Unicorn-61797.exe
2840	Unicorn-33955.exe
2652	Unicorn-53821.exe
2184	Unicorn-15018.exe
2708	Unicorn-29317.exe
2584	Unicorn-45845.exe
2816	Unicorn-35570.exe
2536	Unicorn-24635.exe
532	Unicorn-11828.exe
776	Unicorn-36525.exe
3060	Unicorn-323.exe
2260	Unicorn-20189.exe
2160	Unicorn-28357.exe
2528	Unicorn-33187.exe
2376	Unicorn-8683.exe
1276	Unicorn-33379.exe
2916	Unicorn-20573.exe
3016	Unicorn-20573.exe
2076	Unicorn-25579.exe
1612	Unicorn-44915.exe
1112	Unicorn-51045.exe
1920	Unicorn-20602.exe
2188	Unicorn-54444.exe
2244	Unicorn-54444.exe
2020	Unicorn-562.exe
1080	Unicorn-20428.exe
1840	Unicorn-20162.exe
1592	Unicorn-12186.exe
1676	Unicorn-30215.exe

Loads dropped DLL 64 IoCs

pid	Process
2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
2684	Unicorn-38063.exe
2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
2684	Unicorn-38063.exe
2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
2696	Unicorn-2959.exe
2696	Unicorn-2959.exe
2688	Unicorn-12751.exe
2684	Unicorn-38063.exe
2688	Unicorn-12751.exe
2684	Unicorn-38063.exe
2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
2540	Unicorn-58081.exe
2540	Unicorn-58081.exe
2684	Unicorn-38063.exe
2684	Unicorn-38063.exe
2656	Unicorn-12409.exe
2892	Unicorn-4241.exe
2892	Unicorn-4241.exe
2656	Unicorn-12409.exe
2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
3048	Unicorn-39144.exe
2696	Unicorn-2959.exe
2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
3048	Unicorn-39144.exe
2688	Unicorn-12751.exe
2688	Unicorn-12751.exe
2696	Unicorn-2959.exe
1476	Unicorn-26639.exe
1476	Unicorn-26639.exe
2540	Unicorn-58081.exe
2540	Unicorn-58081.exe
2428	Unicorn-32607.exe
2428	Unicorn-32607.exe
2892	Unicorn-4241.exe
2892	Unicorn-4241.exe
3064	Unicorn-53373.exe
3064	Unicorn-53373.exe
2684	Unicorn-38063.exe
2452	Unicorn-40775.exe
2684	Unicorn-38063.exe
2452	Unicorn-40775.exe
3048	Unicorn-39144.exe
3048	Unicorn-39144.exe
2792	Unicorn-4765.exe
2792	Unicorn-4765.exe
2696	Unicorn-2959.exe
2696	Unicorn-2959.exe
1248	Unicorn-24366.exe
1248	Unicorn-24366.exe
1904	Unicorn-32607.exe
1904	Unicorn-32607.exe
2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
892	Unicorn-13125.exe
892	Unicorn-13125.exe
2656	Unicorn-12409.exe
2656	Unicorn-12409.exe
2688	Unicorn-12751.exe
2688	Unicorn-12751.exe
1900	Unicorn-39161.exe
1900	Unicorn-39161.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3660	2464	WerFault.exe	97
5948	2984	WerFault.exe	125

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38764.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
2684	Unicorn-38063.exe
2696	Unicorn-2959.exe
2688	Unicorn-12751.exe
2540	Unicorn-58081.exe
2892	Unicorn-4241.exe
2656	Unicorn-12409.exe
3048	Unicorn-39144.exe
1476	Unicorn-26639.exe
2428	Unicorn-32607.exe
3064	Unicorn-53373.exe
2792	Unicorn-4765.exe
1904	Unicorn-32607.exe
892	Unicorn-13125.exe
2452	Unicorn-40775.exe
1248	Unicorn-24366.exe
1900	Unicorn-39161.exe
2960	Unicorn-46239.exe
2512	Unicorn-38262.exe
2460	Unicorn-8735.exe
2208	Unicorn-8927.exe
632	Unicorn-41792.exe
2168	Unicorn-41527.exe
2060	Unicorn-46623.exe
1908	Unicorn-17288.exe
1960	Unicorn-44022.exe
1600	Unicorn-50152.exe
1520	Unicorn-58512.exe
1308	Unicorn-6157.exe
2976	Unicorn-19726.exe
604	Unicorn-39592.exe
3000	Unicorn-789.exe
2256	Unicorn-28466.exe
1728	Unicorn-624.exe
2304	Unicorn-60562.exe
1548	Unicorn-5423.exe
2748	Unicorn-61797.exe
2840	Unicorn-33955.exe
2652	Unicorn-53821.exe
2184	Unicorn-15018.exe
2708	Unicorn-29317.exe
2584	Unicorn-45845.exe
2816	Unicorn-35570.exe
532	Unicorn-11828.exe
2536	Unicorn-24635.exe
2160	Unicorn-28357.exe
776	Unicorn-36525.exe
3060	Unicorn-323.exe
2260	Unicorn-20189.exe
2528	Unicorn-33187.exe
2376	Unicorn-8683.exe
1276	Unicorn-33379.exe
2916	Unicorn-20573.exe
3016	Unicorn-20573.exe
2076	Unicorn-25579.exe
1112	Unicorn-51045.exe
1612	Unicorn-44915.exe
1920	Unicorn-20602.exe
2188	Unicorn-54444.exe
2244	Unicorn-54444.exe
1840	Unicorn-20162.exe
2020	Unicorn-562.exe
1080	Unicorn-20428.exe
1592	Unicorn-12186.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2684	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	30
PID 2440 wrote to memory of 2684	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	30
PID 2440 wrote to memory of 2684	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	30
PID 2440 wrote to memory of 2684	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	30
PID 2684 wrote to memory of 2696	2684	Unicorn-38063.exe	31
PID 2684 wrote to memory of 2696	2684	Unicorn-38063.exe	31
PID 2684 wrote to memory of 2696	2684	Unicorn-38063.exe	31
PID 2684 wrote to memory of 2696	2684	Unicorn-38063.exe	31
PID 2440 wrote to memory of 2688	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	32
PID 2440 wrote to memory of 2688	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	32
PID 2440 wrote to memory of 2688	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	32
PID 2440 wrote to memory of 2688	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	32
PID 2696 wrote to memory of 2892	2696	Unicorn-2959.exe	33
PID 2696 wrote to memory of 2892	2696	Unicorn-2959.exe	33
PID 2696 wrote to memory of 2892	2696	Unicorn-2959.exe	33
PID 2696 wrote to memory of 2892	2696	Unicorn-2959.exe	33
PID 2688 wrote to memory of 2656	2688	Unicorn-12751.exe	34
PID 2688 wrote to memory of 2656	2688	Unicorn-12751.exe	34
PID 2688 wrote to memory of 2656	2688	Unicorn-12751.exe	34
PID 2688 wrote to memory of 2656	2688	Unicorn-12751.exe	34
PID 2684 wrote to memory of 2540	2684	Unicorn-38063.exe	35
PID 2684 wrote to memory of 2540	2684	Unicorn-38063.exe	35
PID 2684 wrote to memory of 2540	2684	Unicorn-38063.exe	35
PID 2684 wrote to memory of 2540	2684	Unicorn-38063.exe	35
PID 2440 wrote to memory of 3048	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	36
PID 2440 wrote to memory of 3048	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	36
PID 2440 wrote to memory of 3048	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	36
PID 2440 wrote to memory of 3048	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	36
PID 2540 wrote to memory of 1476	2540	Unicorn-58081.exe	37
PID 2540 wrote to memory of 1476	2540	Unicorn-58081.exe	37
PID 2540 wrote to memory of 1476	2540	Unicorn-58081.exe	37
PID 2540 wrote to memory of 1476	2540	Unicorn-58081.exe	37
PID 2684 wrote to memory of 3064	2684	Unicorn-38063.exe	38
PID 2684 wrote to memory of 3064	2684	Unicorn-38063.exe	38
PID 2684 wrote to memory of 3064	2684	Unicorn-38063.exe	38
PID 2684 wrote to memory of 3064	2684	Unicorn-38063.exe	38
PID 2892 wrote to memory of 2428	2892	Unicorn-4241.exe	39
PID 2892 wrote to memory of 2428	2892	Unicorn-4241.exe	39
PID 2892 wrote to memory of 2428	2892	Unicorn-4241.exe	39
PID 2892 wrote to memory of 2428	2892	Unicorn-4241.exe	39
PID 2656 wrote to memory of 1904	2656	Unicorn-12409.exe	40
PID 2656 wrote to memory of 1904	2656	Unicorn-12409.exe	40
PID 2656 wrote to memory of 1904	2656	Unicorn-12409.exe	40
PID 2656 wrote to memory of 1904	2656	Unicorn-12409.exe	40
PID 2440 wrote to memory of 1248	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	42
PID 2440 wrote to memory of 1248	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	42
PID 2440 wrote to memory of 1248	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	42
PID 2440 wrote to memory of 1248	2440	1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe	42
PID 3048 wrote to memory of 2452	3048	Unicorn-39144.exe	41
PID 3048 wrote to memory of 2452	3048	Unicorn-39144.exe	41
PID 3048 wrote to memory of 2452	3048	Unicorn-39144.exe	41
PID 3048 wrote to memory of 2452	3048	Unicorn-39144.exe	41
PID 2688 wrote to memory of 892	2688	Unicorn-12751.exe	44
PID 2688 wrote to memory of 892	2688	Unicorn-12751.exe	44
PID 2688 wrote to memory of 892	2688	Unicorn-12751.exe	44
PID 2688 wrote to memory of 892	2688	Unicorn-12751.exe	44
PID 2696 wrote to memory of 2792	2696	Unicorn-2959.exe	43
PID 2696 wrote to memory of 2792	2696	Unicorn-2959.exe	43
PID 2696 wrote to memory of 2792	2696	Unicorn-2959.exe	43
PID 2696 wrote to memory of 2792	2696	Unicorn-2959.exe	43
PID 1476 wrote to memory of 1900	1476	Unicorn-26639.exe	45
PID 1476 wrote to memory of 1900	1476	Unicorn-26639.exe	45
PID 1476 wrote to memory of 1900	1476	Unicorn-26639.exe	45
PID 1476 wrote to memory of 1900	1476	Unicorn-26639.exe	45

C:\Users\Admin\AppData\Local\Temp\1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe
"C:\Users\Admin\AppData\Local\Temp\1492f5d14cb415eb76fb5f4ad21129b09bd5a786b34bf9c2bab547a59477a611N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2959.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40433.exe
        8⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
        9⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        9⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        8⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9179.exe
        8⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        8⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21738.exe
        8⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12420.exe
        8⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30655.exe
        7⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        8⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32514.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55411.exe
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3354.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5203.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16086.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29224.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 240
        8⤵
        Program crash
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        6⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38413.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        7⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        8⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
        7⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        7⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
        6⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        7⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        7⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
        6⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38985.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11171.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44915.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40823.exe
        7⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        6⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        6⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10370.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        5⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63570.exe
        6⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14156.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3884.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
        7⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        7⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe
        7⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45456.exe
        6⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        7⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        6⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38985.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2739.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        6⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        7⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20300.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        6⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24285.exe
        5⤵
        
        PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44022.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54444.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        6⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
        7⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33990.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        5⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        5⤵
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
        5⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20300.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35581.exe
      4⤵
      PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
      4⤵
      PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
      4⤵
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39161.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30215.exe
        7⤵
        Executes dropped EXE
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe
        8⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        8⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        8⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8519.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        7⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        7⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
        6⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
        7⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26905.exe
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        6⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64026.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31284.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49535.exe
        7⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51748.exe
        7⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42075.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        5⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        6⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        6⤵
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17201.exe
        6⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        5⤵
        
        PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        6⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64283.exe
        7⤵
        
        PID:844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 236
        7⤵
        Program crash
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        6⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31412.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        6⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        5⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12235.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21469.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13179.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53811.exe
        6⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63700.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12982.exe
        7⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
      4⤵
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63700.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40683.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
      4⤵
      PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48597.exe
      4⤵
      PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53373.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8927.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56447.exe
        6⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
        7⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50756.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
        7⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
        7⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        6⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        5⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4026.exe
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        6⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33955.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
        5⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46892.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        6⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12982.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        5⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33020.exe
      4⤵
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30447.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exe
        5⤵
        
        PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exe
      4⤵
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15706.exe
        5⤵
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33990.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16687.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24951.exe
      4⤵
      PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53856.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11867.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2209.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53591.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
      4⤵
      PID:6632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35570.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15782.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
      4⤵
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
      4⤵
      PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55300.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
    3⤵
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11547.exe
    3⤵
    PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27416.exe
    3⤵
    PID:5496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12409.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58512.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        7⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exe
        6⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21550.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        6⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        7⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        7⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8519.exe
        7⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe
        6⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        6⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        6⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        5⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48851.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
        6⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30249.exe
        5⤵
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62741.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54913.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19726.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53821.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
        6⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60733.exe
        7⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61546.exe
        6⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        5⤵
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
        6⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18779.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44529.exe
        5⤵
        
        PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13179.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        5⤵
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
        6⤵
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        6⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13990.exe
        5⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        5⤵
        
        PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
      4⤵
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        5⤵
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
      4⤵
      PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
      4⤵
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
      4⤵
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54444.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54716.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
        6⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        5⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        5⤵
        
        PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-562.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
        6⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
        5⤵
        
        PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35540.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13512.exe
        5⤵
        
        PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42471.exe
      4⤵
      PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54260.exe
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30883.exe
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52356.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
      4⤵
      PID:6584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1320.exe
        5⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15782.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41675.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40992.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22679.exe
      4⤵
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
      4⤵
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
      4⤵
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
      4⤵
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29359.exe
      4⤵
      PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
      4⤵
      PID:5828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
    3⤵
    PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
    3⤵
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
    3⤵
    PID:6304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39144.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39144.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41792.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36525.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
        6⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5879.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1087.exe
        7⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        6⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
        5⤵
        
        PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40992.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
        5⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50893.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59708.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
      4⤵
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
        5⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        5⤵
        
        PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
      4⤵
      PID:6980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51045.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        5⤵
        
        PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49535.exe
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37882.exe
        5⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
      4⤵
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13179.exe
      4⤵
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
      4⤵
      PID:5980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20602.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22774.exe
      4⤵
      PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2906.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
      4⤵
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      4⤵
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1102.exe
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
    3⤵
    PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
    3⤵
    PID:6372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28357.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52768.exe
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40992.exe
      4⤵
      PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33379.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
      4⤵
      PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22196.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64558.exe
      4⤵
      PID:6544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46414.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
    3⤵
    PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64026.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6157.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6157.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
      4⤵
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2209.exe
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61546.exe
      4⤵
      PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
      4⤵
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
      4⤵
      PID:6448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
    3⤵
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52711.exe
      4⤵
      PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
      4⤵
      PID:816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      4⤵
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe
      4⤵
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25555.exe
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30629.exe
    3⤵
    PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21665.exe
    3⤵
    PID:6808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6577.exe
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
    3⤵
    PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
    3⤵
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
    3⤵
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34085.exe
    3⤵
    PID:912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
  2⤵
  PID:2568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23925.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23925.exe
  2⤵
  PID:3888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20542.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20542.exe
  2⤵
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
  2⤵
  PID:5288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13624.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13624.exe
  2⤵
  PID:6320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe

Filesize
468KB

MD5
00589d5494a1d8b9ae4c0a5767edd05b

SHA1
1382efb9a506a95146fe5860d3c8c14bde444bc6

SHA256
d1394d6295770f9ae2049c815d4bc8b89cac734307f3f594d662ecd669be1725

SHA512
377b94a82dc559c87f9ae733d0dea3e1c809502bbfcb91a467342e0c1734991825398572d25f4861bb0fbca5f7397be05722307f56b6bc934760c103c9c77e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe

Filesize
468KB

MD5
1ca2deba5d1c6abe753b5cb2beb71a66

SHA1
701df864c51b3750f1e1d0dd04959c1e74993718

SHA256
d237daa84dac09b406dcb2ea26bc28cdce5bf2df5aabe00a607a363a66bd7b8c

SHA512
d837c0c1dbabbc1ee9673592888f6f553fbd899b4e2d4824cce638981baecd448624089917ec71fbfddf2f5b734213814d0b71a3ceb96969a9f4c2c7f581aeaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe

Filesize
468KB

MD5
4b77099ed39142913e71cd9bc1c24d72

SHA1
4d8e10e80b8e26dd7cefd9a6da33885ab7de0089

SHA256
1dbdf28d57e7bb7ca5be4f8738d5354ce7fec7d4d25fa133ab0e380744fce9f6

SHA512
42358dab70d9af22e65706d60c85017d2b71b3bfac5ff45bf153d9e7cdd50286b904f2e2ec8d1b46f755c2ddda4a77efe2989bee576babe8d4aacae1f74b9c6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe

Filesize
468KB

MD5
ff8190ab932cee100df3c122879eed85

SHA1
272d4911b0bb3cb298316f0fcef23456174b8ba5

SHA256
d597d0ef5a4f495ddb0c0dd15897b1aedd19a5bbba8d6c605ca3657fa49592af

SHA512
e5b96db3983ffe3fff52a34597bcbcdcd339d2a349f8ff32b5e8020e36f63efbb7b3c7740e18f7d2d5e3e772a5e18416da915be47aec9e3c605c4aee462d64d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe

Filesize
468KB

MD5
5cc7fd2425ba437209ae5e703495e54b

SHA1
3717c8c34bdbc0813af3472e0a4a6de00214f8fe

SHA256
ba6518fee76f7bb2d2124477e97645b5ff2efd471be93345d9d5ba932acc588e

SHA512
260915ee3b29fba9b19db84a60533379793a5a3368875eb834c74b044028aef6e10e554291ffc54a0f8eeba07323fe2b8203063e588b552326f9019c5b57fb23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60733.exe

Filesize
468KB

MD5
a96826b0015c23daef351725792fd5b4

SHA1
6f7f6946e81e9ce40caa04a9a21da764164acd74

SHA256
13932c2c4d9ec82b8fde8917450ac4c884ce0fde643198a635041bd312ab84a9

SHA512
ca9cc7c9b17ce0df274946abebc92c2c1a403c9e5de3713c2a12c3b6e8c7e1d40f0ffa96517209fae74b4e983083cca6c309fd27e9564f861860d01624eceb65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe

Filesize
468KB

MD5
2e2c8c512b934f7e61e7e4e50a233a14

SHA1
9a8ec85b0ba16304b53e53791b58adf70a1aa5bb

SHA256
120d83459c9440b3f84d6ecdab4f6aee90ab8410f46057fa64052866851e41cd

SHA512
e8b1df76e5f4397151457650b3847ab05e8208b69cf432a41fd37d8d4b8473688a53d52c59ab2161fb47186918da85ea605fc6d0c9ce41dfec110fff873747ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12409.exe

Filesize
468KB

MD5
8629e9091a3739c624704f16f4f37119

SHA1
2da064b32dfbf0c2fdab4eda135356a002608f0e

SHA256
d18443030569c43eceaa24a4b093674723411bac17c96f85c1c505cb0fb41204

SHA512
b90dd778600fbf2cb37676f5f71ad8c190f100899cf7b9cb28fcdaa32f26781244a9c23a93a57acc86d7117ceed66476b36fd15810f89b6641e236bd32f2ff1b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe

Filesize
468KB

MD5
92ba3e3063c14af4ba6f9455dcf161a2

SHA1
71f76f15fa98b0e4a9490b0ed6ac5111ce023f70

SHA256
6f2111e83b80ba79d35b5f83344b52c713a1016fee8640e5105eb487c6e7a259

SHA512
fbc51247e7ca47e43144850fa5ae71fe5a86df014e172a74b3c869488825c26694307c570a601f6482eb65ce434b09fbb1740dfdc39148e61e6338af31b4df87

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe

Filesize
468KB

MD5
87efced6e7a0d60ccac176dd6aeb9380

SHA1
1a2b9bc1ed824ddf4ec23f35db1550277072f426

SHA256
8b79a38b04cfa847e69855a71f01992d31e7ff063c877690d534272a65c7ae8c

SHA512
d0c731e268c71e85531dc087657496e222978552a1faf369011e7f7e440be5c38fc93aaf229476385b04f917770544022e5b7889596552ba0ca73c5ec79ef602

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe

Filesize
468KB

MD5
0d536eb0d0eb77dc9a41a64fa7116dc4

SHA1
96540e733fb603cf716868d16e7b3d216ce7aad5

SHA256
751bb31800a545df9f5c84ed361138eb8c69648065e74020036c38c5742e74df

SHA512
aa22c8b927869bff7cb07540833163c0feab5a50f9f23f51aba545103795ba4418ad66b5d02493d7d3fdf39b028f5ee44ebc3fe70f5090b6a2f0e3b9503cc8ff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2959.exe

Filesize
468KB

MD5
357d30aaffdef2737ed7d0588b3d7f83

SHA1
56f38667d6596145b18fae9e38e246c2e6c6b6d9

SHA256
440f0c23308369a2c418110213610c4cf4b777192697dd4fe7468e2045118a19

SHA512
137434ba8dd241593b619641d35a7c92f1732f1570a7c98f6db809721a8741930cadb24ea05a39702c48cfd388071e08e0abf371b602ce54f02361806cc5fbc3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe

Filesize
468KB

MD5
02af678e2160f1de72663eaa412a11a4

SHA1
5f55465ed3769cbde065af45f6db338ba93db557

SHA256
12f7de3bf7cbd83f0bd6173fa1ef1507edeeb939270382ee7bd7d8ff5ba9d344

SHA512
13fa71bf2064f8f07c216c2c6ea6bfec1f4c8a6693408194fadedd855435a866f364444fb0875d9206ae4f8662c2210df7e53226bd96a431b726743558c47cfe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe

Filesize
468KB

MD5
c7ca18d15a7abb7c85b4e31809918db3

SHA1
88b3f31c07780f10f47672651d4c822563c7d619

SHA256
9c22bab4279b82db9bf808997b7717511d36a19f4fe1a59f70ba730d6aacbbf6

SHA512
8393664cc1c021011c62d82ed60f369c9e4262cb19712aafcce878b39fb61d68684d628814acb6125193f27a0869742a65e1bfb75f2c99f2f45bb23bbc8c8224

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe

Filesize
468KB

MD5
dac3b6a27454d76f5eb0f086cef1b8d1

SHA1
38de9b325155b3908b1c75076c42312d8b7db2ae

SHA256
3aaa2e927a55b3e490547711940af031284c4a88953f18e0156cf2191dbf32bd

SHA512
a26fa235e9394a8d2a6da3d04223dc510639c31b1fcef573a481f914297f0f56dd5b43d4be8a3f778609046bdb8f0f0904d52f12109993bebad8d73ffc2635e7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39144.exe

Filesize
468KB

MD5
fc566302c15d22a9deeafdad0bad6e96

SHA1
220795d3f0a0f55c5876eca4143ee92adfa4aadd

SHA256
7aeed92c9d0fb89d73c17bb1fe12d8e1633081233c527228083d40edd8b44596

SHA512
dc8c9dbd9b4c0976807bf2345c458459eb0343fb6e8259387c2bd2556fcc38d000d4675b45ea7d4f33df93bcc763b757514cc7676f82d6ef8b8615f35634e7d6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39161.exe

Filesize
468KB

MD5
c23c5d5cfa54d0629a596cd1e22675af

SHA1
2a4faa4def00a8637f52f708b0ca14ceadd2a0a7

SHA256
bb4abce7d537799480ae68b85e25fddb76a507427c883712ebd13c14088746a4

SHA512
861d66b0c0f9f5ece8a6358449ec37a71fbe051f91a3822b8395b71bdaab00b3d4e38dfac09ee9d196e6fe29ae122215f6f676098a2b65a8baee9019a854cc58

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe

Filesize
468KB

MD5
216b721e02f9847c1a01c840343bec1b

SHA1
4e680924fc6e1cf7b25d25b62618e49cd2883e92

SHA256
3e42f0bc1cf882e6b59e9bd8a81d118b94cde5849dac848d2420f14083e7650c

SHA512
9913209e46e7c7f2888b16fcfb71a87d5dff0f4ac29c35f1fa20290524f38a5da36791b821ceab41a4bf5131317fb8243816647e2e593b7d1279415167634f11

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe

Filesize
468KB

MD5
a5e0a4610dfafab48d30fbd71968bb22

SHA1
dec12e0e427f6ad6d88d4fd6ff96b66afa1b4187

SHA256
873ab4da7e8ea5fb78e4e7f2585156ab227821d15668fab2a9e12f659ca94820

SHA512
9835ed27d929e13a870385ea90829edb046024fc7a1dbddb46290673cdfdc0ad474e37a732e26875d63db2a359432a5651c8c060d4c00f5cef7088b23396c963

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53373.exe

Filesize
468KB

MD5
18b016318ee691b0bf75624d1857635d

SHA1
118226b8b5d70027af3efd8d021cb573393f7788

SHA256
2606f0ea59418e404ebf69b6d0bb18df0d3230eccc7898622654ee0430f150cc

SHA512
f5e7a5a1fac48940e7a1067c7ddc63864619024813ab22edfe04bcb1d8b6a10a851ac419870ea959703f1a0cdbd024b1eccf50ffa4ac354638a5998c99031c8a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe

Filesize
468KB

MD5
ebfb4713cbc47192cc9a98d1abc385d2

SHA1
5f2823b1fca0705aa7ba56100d1929374ce4f931

SHA256
7b81df6a6ab739df21a1ca74d2d372c463b1938454fdfd2607f0e37bbee3c678

SHA512
9c20f909d170d88643e372aaf2afd9e6c52a76c5843c05bfa343d01b14652a7cc64b5e7f2353f9baf91194e5502589571c8ad47ee313c8d8e14c4c160ddf06ef

Download Submit