8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
Size

468KB
MD5

275a853e96c7e28331dabe7bb6fed7d7
SHA1

c3393bfabe8d9569666d4be3149aed261ddb86d3
SHA256

8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d
SHA512

4b3d62fd38e6b8b577852545a9cf80dfbe9325906ab10a2e8dbe1e99aff1f2c4cf4da3d67cfd2a176ecce2ca201c083c7d46186f8d180f7cb603af2d561d00c7
SSDEEP

3072:ToA1ogYnI05ptbYnPz4jef8/ECx8PgpKcmHe6Vs/8T4T/Miuk4lt:ToCom8ptkPEjefZcfn8TuUiuk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1944	Unicorn-43281.exe
1828	Unicorn-39472.exe
2268	Unicorn-24720.exe
2752	Unicorn-29586.exe
2864	Unicorn-12564.exe
3028	Unicorn-23455.exe
2928	Unicorn-31349.exe
2620	Unicorn-20503.exe
2236	Unicorn-23278.exe
2348	Unicorn-43144.exe
1820	Unicorn-28535.exe
468	Unicorn-11862.exe
1808	Unicorn-47700.exe
2104	Unicorn-14934.exe
2668	Unicorn-41835.exe
2956	Unicorn-54227.exe
1456	Unicorn-35928.exe
2144	Unicorn-43018.exe
1668	Unicorn-54122.exe
2580	Unicorn-64284.exe
448	Unicorn-48031.exe
1616	Unicorn-25669.exe
2500	Unicorn-45535.exe
2524	Unicorn-21969.exe
2100	Unicorn-52992.exe
1492	Unicorn-7320.exe
1796	Unicorn-7320.exe
996	Unicorn-37855.exe
1728	Unicorn-9983.exe
1628	Unicorn-2748.exe
1656	Unicorn-31394.exe
1088	Unicorn-14853.exe
2408	Unicorn-43311.exe
1604	Unicorn-10245.exe
1920	Unicorn-17371.exe
2368	Unicorn-56192.exe
2796	Unicorn-19902.exe
2148	Unicorn-40728.exe
2868	Unicorn-65289.exe
2608	Unicorn-12134.exe
2352	Unicorn-42564.exe
2892	Unicorn-28964.exe
2736	Unicorn-54750.exe
2764	Unicorn-34884.exe
772	Unicorn-47084.exe
2204	Unicorn-15664.exe
2672	Unicorn-65367.exe
2812	Unicorn-16083.exe
668	Unicorn-16083.exe
988	Unicorn-946.exe
1816	Unicorn-44522.exe
860	Unicorn-28269.exe
1484	Unicorn-51085.exe
2980	Unicorn-31749.exe
2984	Unicorn-537.exe
2260	Unicorn-28845.exe
2232	Unicorn-1299.exe
1040	Unicorn-9414.exe
2384	Unicorn-15544.exe
1824	Unicorn-31235.exe
1244	Unicorn-54600.exe
308	Unicorn-21553.exe
904	Unicorn-54548.exe
3048	Unicorn-46882.exe

Loads dropped DLL 64 IoCs

pid	Process
2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
1944	Unicorn-43281.exe
2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
1944	Unicorn-43281.exe
1828	Unicorn-39472.exe
2268	Unicorn-24720.exe
2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
2268	Unicorn-24720.exe
1828	Unicorn-39472.exe
2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
1944	Unicorn-43281.exe
1944	Unicorn-43281.exe
2864	Unicorn-12564.exe
2864	Unicorn-12564.exe
1828	Unicorn-39472.exe
1828	Unicorn-39472.exe
2752	Unicorn-29586.exe
2752	Unicorn-29586.exe
2268	Unicorn-24720.exe
2268	Unicorn-24720.exe
2928	Unicorn-31349.exe
2928	Unicorn-31349.exe
2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
1944	Unicorn-43281.exe
2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
1944	Unicorn-43281.exe
3028	Unicorn-23455.exe
3028	Unicorn-23455.exe
2236	Unicorn-23278.exe
2236	Unicorn-23278.exe
1828	Unicorn-39472.exe
1828	Unicorn-39472.exe
1820	Unicorn-28535.exe
1820	Unicorn-28535.exe
2268	Unicorn-24720.exe
2268	Unicorn-24720.exe
2620	Unicorn-20503.exe
2620	Unicorn-20503.exe
2348	Unicorn-43144.exe
2348	Unicorn-43144.exe
2864	Unicorn-12564.exe
2104	Unicorn-14934.exe
2864	Unicorn-12564.exe
2104	Unicorn-14934.exe
2752	Unicorn-29586.exe
2752	Unicorn-29586.exe
3028	Unicorn-23455.exe
3028	Unicorn-23455.exe
468	Unicorn-11862.exe
1808	Unicorn-47700.exe
468	Unicorn-11862.exe
1808	Unicorn-47700.exe
2668	Unicorn-41835.exe
2668	Unicorn-41835.exe
2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
2928	Unicorn-31349.exe
2928	Unicorn-31349.exe
1944	Unicorn-43281.exe
1944	Unicorn-43281.exe
2956	Unicorn-54227.exe
2956	Unicorn-54227.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2136	2232	WerFault.exe	87
5008	2068	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15342.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
1944	Unicorn-43281.exe
1828	Unicorn-39472.exe
2268	Unicorn-24720.exe
2752	Unicorn-29586.exe
2864	Unicorn-12564.exe
2928	Unicorn-31349.exe
3028	Unicorn-23455.exe
2620	Unicorn-20503.exe
2236	Unicorn-23278.exe
2348	Unicorn-43144.exe
1820	Unicorn-28535.exe
2104	Unicorn-14934.exe
1808	Unicorn-47700.exe
468	Unicorn-11862.exe
2668	Unicorn-41835.exe
2956	Unicorn-54227.exe
1456	Unicorn-35928.exe
2144	Unicorn-43018.exe
1668	Unicorn-54122.exe
2580	Unicorn-64284.exe
448	Unicorn-48031.exe
2500	Unicorn-45535.exe
1492	Unicorn-7320.exe
1616	Unicorn-25669.exe
2100	Unicorn-52992.exe
996	Unicorn-37855.exe
1796	Unicorn-7320.exe
2524	Unicorn-21969.exe
1728	Unicorn-9983.exe
1628	Unicorn-2748.exe
1656	Unicorn-31394.exe
1088	Unicorn-14853.exe
2408	Unicorn-43311.exe
1604	Unicorn-10245.exe
2368	Unicorn-56192.exe
1920	Unicorn-17371.exe
2796	Unicorn-19902.exe
2148	Unicorn-40728.exe
2868	Unicorn-65289.exe
2608	Unicorn-12134.exe
2352	Unicorn-42564.exe
2892	Unicorn-28964.exe
2736	Unicorn-54750.exe
2764	Unicorn-34884.exe
772	Unicorn-47084.exe
2204	Unicorn-15664.exe
668	Unicorn-16083.exe
2812	Unicorn-16083.exe
2672	Unicorn-65367.exe
988	Unicorn-946.exe
1816	Unicorn-44522.exe
860	Unicorn-28269.exe
1484	Unicorn-51085.exe
2980	Unicorn-31749.exe
2984	Unicorn-537.exe
2260	Unicorn-28845.exe
1040	Unicorn-9414.exe
2232	Unicorn-1299.exe
2384	Unicorn-15544.exe
1824	Unicorn-31235.exe
1244	Unicorn-54600.exe
308	Unicorn-21553.exe
904	Unicorn-54548.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1944	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	30
PID 2112 wrote to memory of 1944	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	30
PID 2112 wrote to memory of 1944	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	30
PID 2112 wrote to memory of 1944	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	30
PID 2112 wrote to memory of 1828	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	32
PID 2112 wrote to memory of 1828	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	32
PID 2112 wrote to memory of 1828	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	32
PID 2112 wrote to memory of 1828	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	32
PID 1944 wrote to memory of 2268	1944	Unicorn-43281.exe	31
PID 1944 wrote to memory of 2268	1944	Unicorn-43281.exe	31
PID 1944 wrote to memory of 2268	1944	Unicorn-43281.exe	31
PID 1944 wrote to memory of 2268	1944	Unicorn-43281.exe	31
PID 2268 wrote to memory of 2752	2268	Unicorn-24720.exe	35
PID 2268 wrote to memory of 2752	2268	Unicorn-24720.exe	35
PID 2268 wrote to memory of 2752	2268	Unicorn-24720.exe	35
PID 2268 wrote to memory of 2752	2268	Unicorn-24720.exe	35
PID 1828 wrote to memory of 2864	1828	Unicorn-39472.exe	33
PID 1828 wrote to memory of 2864	1828	Unicorn-39472.exe	33
PID 1828 wrote to memory of 2864	1828	Unicorn-39472.exe	33
PID 1828 wrote to memory of 2864	1828	Unicorn-39472.exe	33
PID 2112 wrote to memory of 3028	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	34
PID 2112 wrote to memory of 3028	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	34
PID 2112 wrote to memory of 3028	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	34
PID 2112 wrote to memory of 3028	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	34
PID 1944 wrote to memory of 2928	1944	Unicorn-43281.exe	36
PID 1944 wrote to memory of 2928	1944	Unicorn-43281.exe	36
PID 1944 wrote to memory of 2928	1944	Unicorn-43281.exe	36
PID 1944 wrote to memory of 2928	1944	Unicorn-43281.exe	36
PID 2864 wrote to memory of 2620	2864	Unicorn-12564.exe	38
PID 2864 wrote to memory of 2620	2864	Unicorn-12564.exe	38
PID 2864 wrote to memory of 2620	2864	Unicorn-12564.exe	38
PID 2864 wrote to memory of 2620	2864	Unicorn-12564.exe	38
PID 1828 wrote to memory of 2236	1828	Unicorn-39472.exe	39
PID 1828 wrote to memory of 2236	1828	Unicorn-39472.exe	39
PID 1828 wrote to memory of 2236	1828	Unicorn-39472.exe	39
PID 1828 wrote to memory of 2236	1828	Unicorn-39472.exe	39
PID 2752 wrote to memory of 2348	2752	Unicorn-29586.exe	40
PID 2752 wrote to memory of 2348	2752	Unicorn-29586.exe	40
PID 2752 wrote to memory of 2348	2752	Unicorn-29586.exe	40
PID 2752 wrote to memory of 2348	2752	Unicorn-29586.exe	40
PID 2268 wrote to memory of 1820	2268	Unicorn-24720.exe	41
PID 2268 wrote to memory of 1820	2268	Unicorn-24720.exe	41
PID 2268 wrote to memory of 1820	2268	Unicorn-24720.exe	41
PID 2268 wrote to memory of 1820	2268	Unicorn-24720.exe	41
PID 2928 wrote to memory of 468	2928	Unicorn-31349.exe	42
PID 2928 wrote to memory of 468	2928	Unicorn-31349.exe	42
PID 2928 wrote to memory of 468	2928	Unicorn-31349.exe	42
PID 2928 wrote to memory of 468	2928	Unicorn-31349.exe	42
PID 2112 wrote to memory of 1808	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	43
PID 2112 wrote to memory of 1808	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	43
PID 2112 wrote to memory of 1808	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	43
PID 2112 wrote to memory of 1808	2112	8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe	43
PID 1944 wrote to memory of 2668	1944	Unicorn-43281.exe	44
PID 1944 wrote to memory of 2668	1944	Unicorn-43281.exe	44
PID 1944 wrote to memory of 2668	1944	Unicorn-43281.exe	44
PID 1944 wrote to memory of 2668	1944	Unicorn-43281.exe	44
PID 3028 wrote to memory of 2104	3028	Unicorn-23455.exe	45
PID 3028 wrote to memory of 2104	3028	Unicorn-23455.exe	45
PID 3028 wrote to memory of 2104	3028	Unicorn-23455.exe	45
PID 3028 wrote to memory of 2104	3028	Unicorn-23455.exe	45
PID 2236 wrote to memory of 2956	2236	Unicorn-23278.exe	46
PID 2236 wrote to memory of 2956	2236	Unicorn-23278.exe	46
PID 2236 wrote to memory of 2956	2236	Unicorn-23278.exe	46
PID 2236 wrote to memory of 2956	2236	Unicorn-23278.exe	46

C:\Users\Admin\AppData\Local\Temp\8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe
"C:\Users\Admin\AppData\Local\Temp\8f3cb735a7fe13f6c36af35e824c27e5fd0e40799611ad33804a76735a4ce93d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29586.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43144.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48031.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
        7⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        8⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        8⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        8⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44378.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27473.exe
        7⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33918.exe
        7⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65367.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        7⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2678.exe
        8⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        8⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24795.exe
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
        8⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51536.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        7⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25021.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36775.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50114.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26830.exe
        6⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        7⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        8⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 212
        8⤵
        Program crash
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        6⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36448.exe
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52384.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
        7⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        6⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47084.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41391.exe
        6⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        7⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        7⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        6⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        6⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        5⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34470.exe
        5⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        5⤵
        
        PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24209.exe
        7⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
        8⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        8⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        8⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        7⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47917.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        7⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
        6⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
        7⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38728.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14565.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        6⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-111.exe
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
        6⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19902.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
        6⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37999.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24151.exe
        7⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        6⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26520.exe
        6⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7274.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49278.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        6⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
        5⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36158.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        5⤵
        
        PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
        6⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        7⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        7⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
        6⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34449.exe
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        6⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26310.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20401.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15495.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        5⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26830.exe
        5⤵
        
        PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        6⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe
        6⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        5⤵
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        5⤵
        
        PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
      4⤵
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22983.exe
        5⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33900.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2086.exe
      4⤵
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60391.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8863.exe
      4⤵
      PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
      4⤵
      PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
      4⤵
      PID:8144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58116.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        7⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        6⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
        6⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34449.exe
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        6⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40141.exe
        6⤵
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28429.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1534.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        7⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        6⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35198.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
        5⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8486.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45595.exe
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        5⤵
        
        PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        6⤵
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5357.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24292.exe
        5⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        5⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        5⤵
        
        PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        5⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        5⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        5⤵
        
        PID:7684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
      4⤵
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3008.exe
        5⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28704.exe
        5⤵
        
        PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35729.exe
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
      4⤵
      PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34272.exe
      4⤵
      PID:8080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41835.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37855.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15664.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        6⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58284.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        7⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        6⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        6⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
        5⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        6⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39455.exe
        5⤵
        
        PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57689.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        5⤵
        
        PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        5⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14565.exe
        5⤵
        
        PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
      4⤵
      PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
      4⤵
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34216.exe
      4⤵
      PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57364.exe
      4⤵
      PID:7968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31394.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3078.exe
        5⤵
        
        PID:744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        5⤵
        
        PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24292.exe
      4⤵
      PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26942.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
      4⤵
      PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
      4⤵
      PID:7784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
      4⤵
      PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
      4⤵
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
      4⤵
      PID:6384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18692.exe
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
    3⤵
    PID:6080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exe
    3⤵
    PID:6612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46766.exe
    3⤵
    PID:7332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20503.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28964.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        8⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        8⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        7⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
        6⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39607.exe
        6⤵
        
        PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45304.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6911.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48323.exe
        8⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        7⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        7⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        7⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53159.exe
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        6⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
        5⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        6⤵
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        6⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35729.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50294.exe
        5⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48745.exe
        5⤵
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25669.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33687.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33048.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55747.exe
        6⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        6⤵
        
        PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17611.exe
        5⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48413.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exe
        6⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-877.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9414.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3633.exe
        5⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
        6⤵
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35198.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42419.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        5⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        6⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
      4⤵
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
      4⤵
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
      4⤵
      PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
      4⤵
      PID:596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19697.exe
      4⤵
      PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3854.exe
      4⤵
      PID:8052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54227.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
        7⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21926.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exe
        8⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40993.exe
        7⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24708.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32068.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        7⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        6⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        6⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21553.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1318.exe
        6⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43864.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59126.exe
        6⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23927.exe
        6⤵
        
        PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        5⤵
        
        PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        5⤵
        
        PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        6⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50494.exe
        6⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        6⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16813.exe
        5⤵
        
        PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60268.exe
        5⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46882.exe
      4⤵
      Executes dropped EXE
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        5⤵
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        6⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        6⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        5⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        5⤵
        
        PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
      4⤵
      PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8486.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
      4⤵
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24158.exe
      4⤵
      PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
      4⤵
      PID:7512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45908.exe
        5⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35208.exe
        6⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41913.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27821.exe
        6⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49584.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51937.exe
        6⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        5⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45595.exe
        5⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        5⤵
        
        PID:8016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6717.exe
      4⤵
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39816.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40353.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27821.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49584.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        5⤵
        
        PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33608.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26611.exe
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3416.exe
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
      4⤵
      PID:7440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15950.exe
      4⤵
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        5⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
        5⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52603.exe
        5⤵
        
        PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
      4⤵
      PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      4⤵
      PID:832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36970.exe
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
      4⤵
      PID:7844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37999.exe
      4⤵
      PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2254.exe
      4⤵
      PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60608.exe
      4⤵
      PID:8096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
    3⤵
    PID:792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32552.exe
    3⤵
    PID:3308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
    3⤵
    PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23897.exe
    3⤵
    PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
    3⤵
    PID:7972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23455.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23455.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14934.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45535.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20830.exe
        5⤵
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11925.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        6⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        5⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exe
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1299.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
        5⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
        6⤵
        
        PID:7472
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 212
        5⤵
        Program crash
        
        PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
      4⤵
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42289.exe
        5⤵
        
        PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15562.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44378.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25032.exe
      4⤵
      PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
      4⤵
      PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52992.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54975.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        6⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        6⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        5⤵
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        5⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        5⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        5⤵
        
        PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
      4⤵
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8988.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe
        5⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        5⤵
        
        PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
      4⤵
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
      4⤵
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7691.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        5⤵
        
        PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
      4⤵
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      4⤵
      PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
      4⤵
      PID:7076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
    3⤵
    PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56196.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
      4⤵
      PID:7748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
    3⤵
    PID:2848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
    3⤵
    PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
    3⤵
    PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32790.exe
    3⤵
    PID:6976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
    3⤵
    PID:8088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47700.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47700.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        5⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
        6⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        5⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        5⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        5⤵
        
        PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
      4⤵
      PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
      4⤵
      PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
      4⤵
      PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
      4⤵
      PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46563.exe
      4⤵
      PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe
        5⤵
        
        PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
      4⤵
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
      4⤵
      PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
    3⤵
    PID:876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11305.exe
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exe
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
      4⤵
      PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exe
      4⤵
      PID:7676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59285.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
    3⤵
    PID:5356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
    3⤵
    PID:6912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
    3⤵
    PID:7760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
      4⤵
      PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        5⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        5⤵
        
        PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      4⤵
      PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54873.exe
    3⤵
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
      4⤵
      PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe
      4⤵
      PID:7380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
    3⤵
    PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
    3⤵
    PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
    3⤵
    PID:6776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
    3⤵
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23492.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
      4⤵
      PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
      4⤵
      PID:7204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
    3⤵
    PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
    3⤵
    PID:3960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
    3⤵
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
    3⤵
    PID:6048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
    3⤵
    PID:8128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26808.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26808.exe
  2⤵
  PID:1204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
  2⤵
  PID:3464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
  2⤵
  PID:4320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59489.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59489.exe
  2⤵
  PID:4848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
  2⤵
  PID:6464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
  2⤵
  PID:7572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14934.exe

Filesize
468KB

MD5
273e1a46b50ad3bf7e6ec7104b2e8988

SHA1
c24a11130a7bc9bf364e6ac79e7138023134cb6d

SHA256
8b1bec544348e527744c29cf44a1f4457b7849b974746a64329931e2474d27b2

SHA512
888b791cf3a8c6121730952d1c95b920185ce319bcfafc34c793591b236f3e978bdda4ccfbc567523b4a1142ea0a4642d9b126c1e1d70ae1d6981b947dee9461

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe

Filesize
468KB

MD5
149249a5cf9b44d88a9917546cf1bbcd

SHA1
e5278f73e33c3c65db048dd9948603f8e8e03b66

SHA256
84a436fd36d519ce0b8abf706b7c58b45711419b395231310cf5352db2e0840a

SHA512
70a5ef67162d86a33ba0fb800ec7eca28d922329b44b91002bad7658becde0401de261d20aa24bed4a30f3d39bb1dd9491a637fedca77db10c12bd8b55306aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23455.exe

Filesize
468KB

MD5
fecf5fd953520d57e6b08cb4854581d8

SHA1
6c0194100f224084017c295985109020c6eeea39

SHA256
cf347c15c189552c51522bfb5d49a28e6f57da88aa4eeaf0e6edec01f4722aaa

SHA512
37f229b3db07c909381c2dd8f3a9e5fe1468b23dc90e6bdfcb6181549029788e53c5611922f68f09738c4c1b40746a47ad66551e55b1cce4cfb0e40476204d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe

Filesize
468KB

MD5
15f047d246eccfb11209a13fb8967625

SHA1
7d585fffaf148efc7847cc85ba2868952723b7a9

SHA256
0ed52b9201f483fc2cc718cc4a83c3fc76c99a3292a74f188bab7a71cd005ce8

SHA512
0dd5dd3a7e9d50c9f983e22b3246e871d49ce70ca6ad7f6e8b2312050f0eb67cda24cb012bc02da395ba61c6777e1a346c5caff4a386165d352f022f812bb064

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29586.exe

Filesize
468KB

MD5
db955a7d1e4e59241ddfe037ba9449e4

SHA1
30367e0d7500b3bb3db348c0d52930dbbe37c7d7

SHA256
0f6c0d490e16acd819ca51889f8b0bf3994838216b06c75ab1b6fad49801961f

SHA512
c54d4500f0190b931e80a1b0c9061e4d3d616e367dba1a41000edaf25d5a8a8ed65cc956af877a4d9e05f2a61a77bcd1caf941407187eaa3db2b270480226740

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43144.exe

Filesize
468KB

MD5
4305d948869df3accd36db1c13c3a2f1

SHA1
e01f3b1b48a69f9d538c487f27f861a48741e99b

SHA256
da9e553874f6503cb55d3f536051b1c5e7cf162237fa139044ef9d7ede57697b

SHA512
267d62d71081977c605e622b62c6d1c9c20d67830e7ba5a3d1fc90301d471dae3794a50a490396cb48b69d398c2d8bb5b16a753d82f1bcbb500975e7ca86f437

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe

Filesize
468KB

MD5
6d9a3bdf4a8ce8eb4e029a8a45911718

SHA1
ae374b29cd2b4632d0944f277c2b629cf3f2af67

SHA256
807071d5049a22d54c4bed22d5359e5edc09c7275375f5498c76125d7be1ec55

SHA512
d215cbd4f6e640e025e5f290632e32ccec3435e19988999c36e705f6ce1bd7b7695f038ff72814573a65963ce5ffd91d1cf71d3e206e72eba432e187c86b51ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe

Filesize
468KB

MD5
eb4e57888d90ec6de1b8e888d32a2833

SHA1
47c48879bf74d32ed42839d069f68720075d2904

SHA256
03e4473588043bfca4f9a50a525b03f8f821f3d8579d76df7756bce213d03346

SHA512
b693bea8cb8ad5ac6304821ca2fa48031d08d07e561654b0cb79ee99f38fb54fdf3a12fccaae150c6b8d601457c36ece1a7891fe17d9b295ba4269ae162bf7d5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe

Filesize
468KB

MD5
6cdfde0b59de38bf67062e403eef21ec

SHA1
a31f49ca0078241312922fdb0af83608d4ae73d4

SHA256
57135537cc36b80f567535614bcaaed808eae74b8d957c079ddc19d74cee2372

SHA512
44b19b90a4fffe49fe070f9a4ed72db13a30c618279be6a76f15ccee76ad897daa41d2ca4c90c12164c013275edb6db1aadcb39c210394541a3376ad9bdf50d8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe

Filesize
468KB

MD5
eb5b20881a197f7bee4594e10e5a17c9

SHA1
9e6980866887b17cb31980c44619c964fa5cd4f5

SHA256
af4b16201b54f50d997ac0f34430116c506bee361d27d97ff65f8e3189de7ab5

SHA512
4fb9f801e848cd893ae5cc1e2f45b533708ce33effca235eae47db058d93c4951bf8260476ad4e7b527c51fa88d1014a9b0c852af5cf2f0dfb10c1db22fe92ea

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20503.exe

Filesize
468KB

MD5
d5632b9c217a73e5daaa570d3ed716b1

SHA1
895abc894e43caa61b4993bc5dd611588d5a0b67

SHA256
2eda4ff10016af67770096dda9daabeb395681b1fee7b7badb7e051da61fdbe4

SHA512
fd9288dc4084878ea759c2765475e5b31e456885ff91e586fcc8ba39490c70c26d039fa4454e1201086bce56d0d2cc25f0663a9e7b184b13ae314af219bf15fb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe

Filesize
468KB

MD5
027a135da63591c6ac722e991d3f6e1a

SHA1
8981fa3c11695df71a9ae155105739c1c250cb9e

SHA256
0fa39135b94f55c92e190f29f622a48a147970cbf21bf091148ad527b7cdc7f5

SHA512
a3ba071d98aefe0d0b3b887e9278e7cd6a5353905426645240668fa5525f2801d6a4ffe751bfa3f4ee9dff4832401e9f1168842a3f04aab080a9961f1fe1be84

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe

Filesize
468KB

MD5
81666fd35dd684f7189b572582964b44

SHA1
1648c8915bf54252c211be6ebd26b75ae5db9896

SHA256
929bf6792de042db891a8c1caac53927fa70b99cc90207f22b309200b48ac9c2

SHA512
8ff012aeaf182a36fe5d281afd7d40788096c80f23f5880327f7eeb78a42c1611377dc04bb600d246f4a8f6dce28020901a44d969e07eac6bd38690bc3a3d61e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe

Filesize
468KB

MD5
952fd05c564fa5c679e2e306c73bcc44

SHA1
8085d793f0fc1e214b44dc2c08f670fb171472a2

SHA256
cfbc7afc3fd671d25c7f13e05074783d1083ca5c9996a342caf2f6d2e8f3edd1

SHA512
79665dd13510d9fb0475ab144196fa07b78f8f2c2b080240b6b1573ab52d1e12196da9b50582f945bd98e86253887b6b00aa2aa79f1b650b66515119a5e65636

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe

Filesize
468KB

MD5
553ad54657577d6ffc9e6f59d4c84d56

SHA1
3d271160311f4dd0257e324424bde45a4e993829

SHA256
5fd0c86a6a3746168c440b8dde59fd34a641050da27e4dc83c1a7f23079bd91a

SHA512
f3297733148d23bb093614a03acb2acf4210edf35e611c590ba29cc0311b952395ed6dcce9a4a34c704be6ab44753286c111a3d6893de39f18d37239e1139681

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe

Filesize
468KB

MD5
abf81a78087c0c59b966d7e04d95d0de

SHA1
6bb5823d5e4459f6eac3656851445af7ee33c217

SHA256
62183679a3cece22116369f313e2687a8a55ec397561a451b22d13ddef25dcd8

SHA512
c03902ca94742babcc6c00f6fd32c8b290b5fb8d5c7d0f60e1a863946bd10a55f3a82093d4d685493b63c2f196dcdc6274b53a2cd738e0a1af31074de2a6ae8d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41835.exe

Filesize
468KB

MD5
df6f5fcbaeab263d8d9b260a10faffe8

SHA1
06468df456c6e52bff726fe3bbcd203b197b84f1

SHA256
778f9a3a54265d8f655abaf5ba22c1759713b93e6769ed102c70537a5d31201a

SHA512
29d6d2777c0152d011d37f5a99087fd6dcda4ead9c37894077d2c840e448a80ce5c287beb038f5920d2eb0f8b8494d18ca4fce96817193e7e0d2d22865d4c840

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe

Filesize
468KB

MD5
91343d1b75ed9fff4566c94ce3990cc0

SHA1
409fcba41e89dc5c54aeb01c64502ef2d082676c

SHA256
30f8c12df23dbd10f7d8d1c5bde492f0d7419861ca3f372cbe51a357d4e84691

SHA512
cf096e6dbde601fa347784094d9ac676d97c3c04e00859bb57ab7fc881f76da21a28fd485de10be74b10e49fa6ba7d3b56f8457165f947be6f2db968501228d0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47700.exe

Filesize
468KB

MD5
0db21e354aba0a51b33c99d99b6a8ab4

SHA1
999f42d58861c73c5cd5f89a5e2716d673d54a78

SHA256
2cb6fa7f22c04bde87299a74c345eb5dc9c774105615fabf09cad0007e9594d7

SHA512
6d25f7abd6ab0dd7dcdeac69fe95efa62649a43302db308e28644f626bcd53bedf5d31f6578bbdfcf0985db6f2d11246213b80c37cd72777e24c29b079178e13

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe

Filesize
468KB

MD5
e30d1cc8cbe4d44b61899b931468d5af

SHA1
b9b3881634274df2a2dc9ed7e70f9363f56984ba

SHA256
04445a09f62d9be4631ab03ba0531f853b23c463f849abdc1c46d61e6bf68ed8

SHA512
170d6cc56028e3b1030821a455eb6ba0bd69c79c50f675b99e7fe9db98d7c66e1a3142f04f86f262941b83eff7901cbaa104b74e638c47a681e401d69eff0046

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54227.exe

Filesize
468KB

MD5
e0b55db46c2d78fabdec27b5c50b95a9

SHA1
a331bb7d0251f59de705454fa3c73137af49fa3a

SHA256
84562cc4223851fe82b86f2d8db3144d9deb25507eb1132368ab1b5abffb7dda

SHA512
fc5abda8f9e326db96db185ba4d1fc866a5ea2965781eb6aa2680abbe55e9006d06a6b092c8c9d04365cf4d85121693c385c869619405e7a6b73153a9db2e743

Download Submit