9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98a

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
Size

468KB
MD5

a76f7f19d06ef398f4d9b49a7b426dc0
SHA1

b20fb257c6baae19bb5120aaa25bc7a129dbc550
SHA256

9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98a
SHA512

0ce0567bcc561c9a26ea5608314e3280cde26ae9dd91fedf862f13a6a19b0bc91ee5ff569bf48cc4fee7416c270d00ddc4d26c336b97a29b4f07ee66040266eb
SSDEEP

3072:1GeHo5IKq05UDbYpH5cOcf8/PChzP0p1nLHewVPPqPy+VvmsvRla:1Guoe8UDuHSOcfvYIsqPpZmsv

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1296	Unicorn-8606.exe
2168	Unicorn-23054.exe
2724	Unicorn-44221.exe
2808	Unicorn-26749.exe
2056	Unicorn-38678.exe
2820	Unicorn-18581.exe
2732	Unicorn-12642.exe
2652	Unicorn-29855.exe
3012	Unicorn-49957.exe
1524	Unicorn-64255.exe
1800	Unicorn-64255.exe
2840	Unicorn-12786.exe
2360	Unicorn-32387.exe
576	Unicorn-32652.exe
536	Unicorn-35086.exe
2884	Unicorn-23580.exe
2888	Unicorn-37316.exe
2720	Unicorn-26150.exe
1840	Unicorn-34245.exe
1288	Unicorn-26534.exe
1720	Unicorn-27603.exe
1804	Unicorn-18366.exe
1632	Unicorn-9435.exe
1864	Unicorn-21664.exe
2140	Unicorn-27795.exe
2348	Unicorn-64229.exe
808	Unicorn-48770.exe
1548	Unicorn-3098.exe
3028	Unicorn-9657.exe
2020	Unicorn-62408.exe
864	Unicorn-1510.exe
1432	Unicorn-55693.exe
2100	Unicorn-5158.exe
1684	Unicorn-5423.exe
1412	Unicorn-39859.exe
2448	Unicorn-13508.exe
876	Unicorn-1811.exe
2816	Unicorn-21677.exe
2688	Unicorn-53971.exe
2648	Unicorn-5724.exe
2544	Unicorn-61292.exe
2700	Unicorn-56653.exe
2556	Unicorn-48485.exe
2588	Unicorn-28619.exe
3048	Unicorn-50907.exe
1912	Unicorn-65205.exe
2860	Unicorn-10066.exe
1184	Unicorn-57229.exe
1852	Unicorn-57229.exe
2872	Unicorn-38587.exe
1496	Unicorn-19491.exe
1408	Unicorn-39357.exe
1668	Unicorn-64245.exe
564	Unicorn-64857.exe
1648	Unicorn-58307.exe
2224	Unicorn-57146.exe
2156	Unicorn-8329.exe
2424	Unicorn-54001.exe
1232	Unicorn-63897.exe
988	Unicorn-29383.exe
2028	Unicorn-50358.exe
1876	Unicorn-53887.exe
2252	Unicorn-38437.exe
1984	Unicorn-52735.exe

Loads dropped DLL 64 IoCs

pid	Process
2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
1296	Unicorn-8606.exe
1296	Unicorn-8606.exe
2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
2168	Unicorn-23054.exe
2168	Unicorn-23054.exe
1296	Unicorn-8606.exe
1296	Unicorn-8606.exe
2724	Unicorn-44221.exe
2724	Unicorn-44221.exe
2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
2056	Unicorn-38678.exe
2056	Unicorn-38678.exe
1296	Unicorn-8606.exe
1296	Unicorn-8606.exe
2732	Unicorn-12642.exe
2732	Unicorn-12642.exe
2820	Unicorn-18581.exe
2820	Unicorn-18581.exe
2168	Unicorn-23054.exe
2168	Unicorn-23054.exe
2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
2808	Unicorn-26749.exe
2808	Unicorn-26749.exe
2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
2652	Unicorn-29855.exe
2652	Unicorn-29855.exe
2724	Unicorn-44221.exe
2056	Unicorn-38678.exe
2056	Unicorn-38678.exe
2724	Unicorn-44221.exe
3012	Unicorn-49957.exe
3012	Unicorn-49957.exe
1296	Unicorn-8606.exe
1296	Unicorn-8606.exe
2360	Unicorn-32387.exe
2360	Unicorn-32387.exe
2840	Unicorn-12786.exe
2840	Unicorn-12786.exe
576	Unicorn-32652.exe
576	Unicorn-32652.exe
2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
2168	Unicorn-23054.exe
2168	Unicorn-23054.exe
1800	Unicorn-64255.exe
1800	Unicorn-64255.exe
2808	Unicorn-26749.exe
2808	Unicorn-26749.exe
2820	Unicorn-18581.exe
1524	Unicorn-64255.exe
1524	Unicorn-64255.exe
2820	Unicorn-18581.exe
2732	Unicorn-12642.exe
2732	Unicorn-12642.exe
536	Unicorn-35086.exe
536	Unicorn-35086.exe
2652	Unicorn-29855.exe
2652	Unicorn-29855.exe
2888	Unicorn-37316.exe
2888	Unicorn-37316.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3196	988	WerFault.exe	90
1076	2300	WerFault.exe	113
4840	4284	WerFault.exe	386

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54175.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
1296	Unicorn-8606.exe
2168	Unicorn-23054.exe
2724	Unicorn-44221.exe
2056	Unicorn-38678.exe
2808	Unicorn-26749.exe
2820	Unicorn-18581.exe
2732	Unicorn-12642.exe
2652	Unicorn-29855.exe
3012	Unicorn-49957.exe
2360	Unicorn-32387.exe
1800	Unicorn-64255.exe
1524	Unicorn-64255.exe
2840	Unicorn-12786.exe
576	Unicorn-32652.exe
536	Unicorn-35086.exe
2888	Unicorn-37316.exe
2884	Unicorn-23580.exe
2720	Unicorn-26150.exe
1840	Unicorn-34245.exe
1288	Unicorn-26534.exe
1720	Unicorn-27603.exe
1632	Unicorn-9435.exe
1804	Unicorn-18366.exe
2348	Unicorn-64229.exe
2140	Unicorn-27795.exe
1864	Unicorn-21664.exe
808	Unicorn-48770.exe
1548	Unicorn-3098.exe
3028	Unicorn-9657.exe
2020	Unicorn-62408.exe
864	Unicorn-1510.exe
1432	Unicorn-55693.exe
2100	Unicorn-5158.exe
1684	Unicorn-5423.exe
1412	Unicorn-39859.exe
876	Unicorn-1811.exe
2448	Unicorn-13508.exe
2816	Unicorn-21677.exe
2688	Unicorn-53971.exe
2648	Unicorn-5724.exe
2544	Unicorn-61292.exe
2700	Unicorn-56653.exe
2556	Unicorn-48485.exe
2588	Unicorn-28619.exe
1912	Unicorn-65205.exe
1184	Unicorn-57229.exe
3048	Unicorn-50907.exe
2860	Unicorn-10066.exe
1852	Unicorn-57229.exe
2872	Unicorn-38587.exe
1496	Unicorn-19491.exe
1408	Unicorn-39357.exe
1668	Unicorn-64245.exe
564	Unicorn-64857.exe
1648	Unicorn-58307.exe
2224	Unicorn-57146.exe
2156	Unicorn-8329.exe
2424	Unicorn-54001.exe
1232	Unicorn-63897.exe
2028	Unicorn-50358.exe
988	Unicorn-29383.exe
1876	Unicorn-53887.exe
2252	Unicorn-38437.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1296	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	31
PID 2500 wrote to memory of 1296	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	31
PID 2500 wrote to memory of 1296	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	31
PID 2500 wrote to memory of 1296	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	31
PID 1296 wrote to memory of 2168	1296	Unicorn-8606.exe	33
PID 1296 wrote to memory of 2168	1296	Unicorn-8606.exe	33
PID 1296 wrote to memory of 2168	1296	Unicorn-8606.exe	33
PID 1296 wrote to memory of 2168	1296	Unicorn-8606.exe	33
PID 2500 wrote to memory of 2724	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	32
PID 2500 wrote to memory of 2724	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	32
PID 2500 wrote to memory of 2724	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	32
PID 2500 wrote to memory of 2724	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	32
PID 2168 wrote to memory of 2808	2168	Unicorn-23054.exe	34
PID 2168 wrote to memory of 2808	2168	Unicorn-23054.exe	34
PID 2168 wrote to memory of 2808	2168	Unicorn-23054.exe	34
PID 2168 wrote to memory of 2808	2168	Unicorn-23054.exe	34
PID 1296 wrote to memory of 2056	1296	Unicorn-8606.exe	35
PID 1296 wrote to memory of 2056	1296	Unicorn-8606.exe	35
PID 1296 wrote to memory of 2056	1296	Unicorn-8606.exe	35
PID 1296 wrote to memory of 2056	1296	Unicorn-8606.exe	35
PID 2724 wrote to memory of 2820	2724	Unicorn-44221.exe	36
PID 2724 wrote to memory of 2820	2724	Unicorn-44221.exe	36
PID 2724 wrote to memory of 2820	2724	Unicorn-44221.exe	36
PID 2724 wrote to memory of 2820	2724	Unicorn-44221.exe	36
PID 2500 wrote to memory of 2732	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	37
PID 2500 wrote to memory of 2732	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	37
PID 2500 wrote to memory of 2732	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	37
PID 2500 wrote to memory of 2732	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	37
PID 2056 wrote to memory of 2652	2056	Unicorn-38678.exe	38
PID 2056 wrote to memory of 2652	2056	Unicorn-38678.exe	38
PID 2056 wrote to memory of 2652	2056	Unicorn-38678.exe	38
PID 2056 wrote to memory of 2652	2056	Unicorn-38678.exe	38
PID 1296 wrote to memory of 3012	1296	Unicorn-8606.exe	39
PID 1296 wrote to memory of 3012	1296	Unicorn-8606.exe	39
PID 1296 wrote to memory of 3012	1296	Unicorn-8606.exe	39
PID 1296 wrote to memory of 3012	1296	Unicorn-8606.exe	39
PID 2732 wrote to memory of 1524	2732	Unicorn-12642.exe	40
PID 2732 wrote to memory of 1524	2732	Unicorn-12642.exe	40
PID 2732 wrote to memory of 1524	2732	Unicorn-12642.exe	40
PID 2732 wrote to memory of 1524	2732	Unicorn-12642.exe	40
PID 2820 wrote to memory of 1800	2820	Unicorn-18581.exe	41
PID 2820 wrote to memory of 1800	2820	Unicorn-18581.exe	41
PID 2820 wrote to memory of 1800	2820	Unicorn-18581.exe	41
PID 2820 wrote to memory of 1800	2820	Unicorn-18581.exe	41
PID 2168 wrote to memory of 2840	2168	Unicorn-23054.exe	42
PID 2168 wrote to memory of 2840	2168	Unicorn-23054.exe	42
PID 2168 wrote to memory of 2840	2168	Unicorn-23054.exe	42
PID 2168 wrote to memory of 2840	2168	Unicorn-23054.exe	42
PID 2808 wrote to memory of 576	2808	Unicorn-26749.exe	44
PID 2808 wrote to memory of 576	2808	Unicorn-26749.exe	44
PID 2808 wrote to memory of 576	2808	Unicorn-26749.exe	44
PID 2808 wrote to memory of 576	2808	Unicorn-26749.exe	44
PID 2500 wrote to memory of 2360	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	43
PID 2500 wrote to memory of 2360	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	43
PID 2500 wrote to memory of 2360	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	43
PID 2500 wrote to memory of 2360	2500	9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe	43
PID 2652 wrote to memory of 536	2652	Unicorn-29855.exe	45
PID 2652 wrote to memory of 536	2652	Unicorn-29855.exe	45
PID 2652 wrote to memory of 536	2652	Unicorn-29855.exe	45
PID 2652 wrote to memory of 536	2652	Unicorn-29855.exe	45
PID 2056 wrote to memory of 2884	2056	Unicorn-38678.exe	47
PID 2056 wrote to memory of 2884	2056	Unicorn-38678.exe	47
PID 2724 wrote to memory of 2888	2724	Unicorn-44221.exe	46
PID 2056 wrote to memory of 2884	2056	Unicorn-38678.exe	47

C:\Users\Admin\AppData\Local\Temp\9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe
"C:\Users\Admin\AppData\Local\Temp\9f8df034296d0531a6079f024af1b7af781501fd47b0923835ddd205e679e98aN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26749.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20961.exe
        8⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        9⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        9⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
        9⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        9⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        9⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        9⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        8⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
        8⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        7⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
        8⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        8⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        8⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
        7⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        7⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4596.exe
        7⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
        6⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65437.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15452.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41940.exe
        7⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65099.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
        6⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
        7⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        6⤵
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13030.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        6⤵
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        6⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        6⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
        5⤵
        
        PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16739.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        5⤵
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12786.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27603.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
        7⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
        8⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13476.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52627.exe
        8⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        7⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55732.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        7⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        6⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61292.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
        6⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        5⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
        6⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9642.exe
        5⤵
        
        PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7876.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15452.exe
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16379.exe
        6⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61574.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4105.exe
        5⤵
        
        PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40864.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49212.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27211.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
      4⤵
      PID:348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
      4⤵
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24942.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24291.exe
      4⤵
      PID:5156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62408.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29383.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
        8⤵
        
        PID:628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 232
        8⤵
        Program crash
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58760.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        7⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50556.exe
        7⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        7⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13865.exe
        6⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58843.exe
        7⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        6⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        7⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        6⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14489.exe
        5⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25134.exe
        5⤵
        
        PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56496.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37742.exe
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15372.exe
        7⤵
        
        PID:308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33527.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        7⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61574.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47582.exe
        5⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        6⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        6⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27653.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13102.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40864.exe
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39859.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2979.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        6⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19235.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        5⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
      4⤵
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40958.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45064.exe
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13508.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54401.exe
        6⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        7⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 188
        8⤵
        Program crash
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        7⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53176.exe
        5⤵
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59964.exe
        5⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13476.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        6⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6662.exe
      4⤵
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10431.exe
        5⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        5⤵
        
        PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        5⤵
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe
      4⤵
      PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
      4⤵
      PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34245.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14981.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
        6⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38977.exe
      4⤵
      PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60824.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        5⤵
        
        PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
      4⤵
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
      4⤵
      PID:6588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53971.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
      4⤵
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        5⤵
        
        PID:3200
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 232
        5⤵
        Program crash
        
        PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
    3⤵
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18619.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55630.exe
      4⤵
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
      4⤵
      PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63775.exe
    3⤵
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30893.exe
    3⤵
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63805.exe
    3⤵
    PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
    3⤵
    PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe
    3⤵
    PID:6436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44221.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44221.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18581.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64255.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        7⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
        7⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        7⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        6⤵
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41940.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41847.exe
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        6⤵
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        5⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        6⤵
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40063.exe
        5⤵
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21198.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        6⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        7⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
        7⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        6⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25259.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39361.exe
        5⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4737.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        6⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54186.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47254.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65099.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37681.exe
        5⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        5⤵
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7239.exe
      4⤵
      PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63245.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35358.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
      4⤵
      PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe
        5⤵
        Executes dropped EXE
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39077.exe
        6⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        5⤵
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16435.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
      4⤵
      PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
      4⤵
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
      4⤵
      PID:6428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
      4⤵
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30271.exe
        5⤵
        
        PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exe
      4⤵
      PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
      4⤵
      PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20808.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43058.exe
    3⤵
    PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
      4⤵
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      4⤵
      PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33218.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51161.exe
    3⤵
    PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21826.exe
    3⤵
    PID:6352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12642.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12642.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64255.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        7⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        7⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        7⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3704.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2247.exe
        5⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64753.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15452.exe
        5⤵
        
        PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58843.exe
        5⤵
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        6⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
      4⤵
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32359.exe
        5⤵
        
        PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
      4⤵
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65437.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
      4⤵
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9657.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        5⤵
        
        PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        5⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        5⤵
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe
      4⤵
      PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      4⤵
      PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
      4⤵
      PID:6616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25101.exe
        5⤵
        
        PID:304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        5⤵
        
        PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29346.exe
      4⤵
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33077.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      4⤵
      PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
      4⤵
      PID:6936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
    3⤵
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
      4⤵
      PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
      4⤵
      PID:6912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53309.exe
    3⤵
    PID:2944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
    3⤵
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
    3⤵
    PID:5276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32387.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32387.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56653.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
        5⤵
        
        PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5065.exe
      4⤵
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7767.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
      4⤵
      PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22961.exe
      4⤵
      PID:6368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28619.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
      4⤵
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14754.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe
      4⤵
      PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15452.exe
      4⤵
      PID:7032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47555.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
    3⤵
    PID:3940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27841.exe
    3⤵
    PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
    3⤵
    PID:5160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
      4⤵
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14894.exe
        5⤵
        
        PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        5⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14943.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
      4⤵
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44353.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24603.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
      4⤵
      PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
      4⤵
      PID:6404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
      4⤵
      PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
      4⤵
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24778.exe
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
    3⤵
    PID:4936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58843.exe
    3⤵
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12371.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
      4⤵
      PID:5180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
    3⤵
    PID:3512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
    3⤵
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe
    3⤵
    PID:5440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
  2⤵
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
    3⤵
    PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
  2⤵
  PID:3436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25558.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25558.exe
  2⤵
  PID:3544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
  2⤵
  PID:5004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
  2⤵
  PID:5628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
  2⤵
  PID:6332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12642.exe

Filesize
468KB

MD5
a10d6a9e6ee7b382778253a034a3b118

SHA1
29b813c26f685e83787b1a7077b8b43909cae468

SHA256
50e7043beeba25a0e4f81ac54baa305981f2b8f1ed73b030906f0b7050146412

SHA512
595e895389395f3e81cb1e3cec9ccdb4436a281f141804c6c0dbe0641d4aae7b4f074996b3e514cd1665576e8854409171ae651ba8b303a0a7cfa39a6f1f10d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12786.exe

Filesize
468KB

MD5
a234511c56e501ba0b59aee584f8208f

SHA1
d662bda44f2bb9fc230ce16d1d033e29a6990106

SHA256
626dee8f14697b87543687e6cc6d0139b816f45d820333cf7f1042c14a074188

SHA512
ffef0403e0f15ff800b93ad782c1a5a442be49dc4733505eb01c07b452de5ee1cc67ec7af38e316e1204e5b6e7e729a56c69f9ea52666eac82f923edbda3ea8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe

Filesize
468KB

MD5
e31c25b30c75586f81f4a35e9ce78aa9

SHA1
72c4f671581aec72259ce7c54f4481144db328bd

SHA256
c4118269d519a8d72bb01348f673556b4a25e49e30c4acc8c3cdabfdec700c22

SHA512
b480485eff615e31da14cdd3a7a27f9144910576e170d2fa03e1864fd331d3e84e23248094ab44941522a2b544eacee828f0504f4ad4d808765490f9697cd937

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44353.exe

Filesize
468KB

MD5
864db880985e0f3189a70ad44d81a14a

SHA1
3fdfc491107a3270cb4a375b6fefc0a4002ec5b7

SHA256
a35dc1898c5b76d9fd1601b315287eeefde3d7d2075f78ef9a711dc9eb58160c

SHA512
90294354ad942415b5eefa271e871c8646c70c32c9036ab60dbcbc4bf490648e554e2015ebf0869bcfde3e2705c2674e4151660428f25d59d61dfeb891ecd435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe

Filesize
468KB

MD5
cbe03d02e4f09e82ba60bd48086528e2

SHA1
903a51541906475f37c00208bdd2766141ac4d83

SHA256
f37333b4d34ed8db09974da247a22bca419ee0be8be3f6395c11869a9837e839

SHA512
fc15cc9ac1980039af878ef8f521d7449a9897cab8727026c8f9ccc773678b6b27ade665b865f765c4626809353e34e6090320e27b0fcb5f6ead5bec89b77893

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18581.exe

Filesize
468KB

MD5
1fc04523103b260659b09aaed2fe9c67

SHA1
b0882481245074c68fc23192f867b3ed48f3462f

SHA256
f09d5aac572e22bf319a26c20b8b395053dc0ef3d30ff114cc0c5d37e522d64c

SHA512
fb97f4544bc1b7ddad31f9b1e37b3b2a2d80b56c971eb9e8913d71e153f713572570cb323163eeddc9cb4dac77f4efa623fcca405f704458b49cdbd0142a2443

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe

Filesize
468KB

MD5
c89378f308e56d8f1eef8dbf604edd80

SHA1
2172ea53abc05548ee1d5551a93a5a3bdbbb3378

SHA256
81849caecf57919f52f783fbcb2540ed0f4ecd917a97d4776c1e40bf93937ab3

SHA512
7f2555fcdbe41850622aabce9fb612e70fc67c69efbdef3b5d26fe6c11cb7af57d9653553506a147e2c5894747f69b52589d0be6e2d6ed58e8845f8ecb52e278

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe

Filesize
468KB

MD5
23c7538bfe0610fad4f452a3304efc08

SHA1
15833005e11306157d5a7d957594e74c1b563669

SHA256
4840a37d04669ac53cd52eb73f2ce640ecbd09569418ba2b31dce47a771609db

SHA512
f5ba370e922148a35b2403fecf26abb8d6e30d175dba91b5b09c31d360c99677fc05245ef197bf85146a53b8b7162b8df5be8f3c00a2ca857618aa73cc69ec70

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26749.exe

Filesize
468KB

MD5
ffed18a41aa4fe001a4d18272cfe3359

SHA1
2e827164cf6f064a1e511cc0e53a13c09a909166

SHA256
e61fab58199437d22f35c049b8baf00d18053a514ee9b83d97c613bd63ca12c5

SHA512
4fc1424cfef65e934fc8245ec3d444fcc5b70a42365c35c61d1e09466d56e48a563b3267f6059ca773416ffb818b45bcfa0b83b38454dc6af10a4eb01ff2edc7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe

Filesize
468KB

MD5
f69aef5b00d6cb7c3059671d708aacc7

SHA1
eb201fea76310c070ceb0b3cd8de6cc69b9f99f7

SHA256
4fa2b5cef98ac804c3da81fe671c0949ecc304a43d49f2145c4ee7b7a3f77933

SHA512
2dc881c94080bce240d7b5e670c56d3d092eeb71e3a215fa5151f49dbc25e5b0d2fffc185f956cf1e58289d2c2f5da9709910c23dd781fe560d3b4288d65141f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32387.exe

Filesize
468KB

MD5
622e5fc244503a49e70c596aa37fe135

SHA1
c89f350d641cff9bc6de27eb5800cd85af4dfb7e

SHA256
a4470b8f351dcf44b02060832442a858137ffba4acb314efbc8890b53d0763d2

SHA512
835efdbc4a20994ba7d24ccdb48b48f66d70b2af6929f9d2c1cd4ab5a9b9c128acd0d82c4f003a9f2001a6ed03eaae6d104dda098491b1a6a8ac2a7a16856fa7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe

Filesize
468KB

MD5
3cd9f801760f17cc1c04566bb9e25ec7

SHA1
7b172ff8166bd3635c7838449f5b9b8d51c901fc

SHA256
6c2abf38100b75fd08078455d4640b5c8ad688849f5d9f9e4f6516b957b1e957

SHA512
39b6810ff32405ad433abd093f709245da8486b4091c8d80e923df329a11d61f4f1dcff6d3198f7561d250cb69c36308d6cb466066ce9652d33c3fb5ebe2a7c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe

Filesize
468KB

MD5
6882dd2776919502b1c0392c6a6cb3a1

SHA1
dcf9a621817a212a0dd4b78dbd51b97c748e28b4

SHA256
fb819307eaaff673bdd7be3b4e504f148bc1154e9e735c2cf76e7e28f086a678

SHA512
c803482260d22a4941db4e5d63bf0cdcdc1a489a6f525c6d9d9188abb47a11f43b97b419fd9ae7ba8e540d2d8d8ea815ff81a4cbcc0636274012cdc9c631eca2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe

Filesize
468KB

MD5
5347be9af3fee3673f8293f723c6a047

SHA1
b7bedee0ffa1b06e9265a3e5ec7bdbd8fb015635

SHA256
6d7c0b78f684c5399dc59846053d44aeb581c57b598d7620a46ff8cb4dc281ae

SHA512
6cfa7228243253fbd77b40cd05f1b66da7a1186922a1644d4ccd08e7c10937056a64e53a0a4e2dc984f56bba8de54777e312f3a6051092e607a563cd989d4c25

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe

Filesize
468KB

MD5
6547e0841034648aa4d1b9f1f188a13a

SHA1
27fc0f4f16fde44936951660c8eaa0d9c693338f

SHA256
11715e6c89624e5038528fcebcf87d1504861e05c94944079e49cdb316271097

SHA512
b62329a0a907cc3c8a113d4631986b3ef60b2939ad7698de98178272ff9df23dbd75882df1364f8fcefde0b2c9735a76595d084486ce57a8d743b6a65d4224d4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44221.exe

Filesize
468KB

MD5
fbc2d4e09083a277b9e5b23056659dc8

SHA1
fcb568e657ae3540c99f86b04552a86d64388f23

SHA256
10faaa67641f41b4277238102ef4d98e2b482d0a1f5fb479771bef6d1984e661

SHA512
a82355e2c8666eb9cda9a37e28ae9e58bfc9d850475a531c59caf96eac4961f49d2f5b821479354dd564427f266e3e7d99cc9f757cc946d96d98936fe3ae0faf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe

Filesize
468KB

MD5
903785c714cb52ff1c88e29ebf5dc160

SHA1
a6dc01b24c570c0f75f18f303a2f6c18acdade86

SHA256
7a136d825068f5bb2a6224d2d83ad77ae2a8f6f55a7db4b74a93757dfc50de95

SHA512
573a48768d2e5f928f86da06035ec57130d2a138ce44ac7c47f066c179812286c996ce6784630c7e80f424edd557de5d3308325404402ede132093d08e9cc8dd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64255.exe

Filesize
468KB

MD5
9fc5e42dfdec2b55ec271e34616ac04a

SHA1
183463bd608a15e6941ec5b93f369f08d184b5d4

SHA256
cefa35ad68fd5a3f11ea862291b6c15693ce5329d2aaee825942286c7f14e29a

SHA512
feaaf6c436e7f96e495917cbcdf7ee693b73fc690dc3e50da55416315c72471e9ba4f32b46634703740a31dadfcec026f6acc08c0a73a140a6b008d520c0f2a6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe

Filesize
468KB

MD5
93da0fcde8e671cf31e4be2f59211b03

SHA1
4f1ca7d600d297b2e09fe81745226d2e308ce348

SHA256
40501f196656055bf37ecaf1a14e883c130bb3fc8ffd6bb20891108e8141dc44

SHA512
2976ca26102e8edc2257a7415209a2a91925c0727ced345f92b99730fb13877c7d4496dca157d93c68e44279a9e1316fcbd1497a2d91b8bb90e4ac8cf24486cf

Download Submit