fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8a

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
Size

468KB
MD5

2f79a843e87e7b836daf8460ebca4b50
SHA1

4dedc2685a0129f2784d9701547162ef7e901204
SHA256

fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8a
SHA512

047609be0b0b6560e1914de1d92bfd77eab05e16d145a1eae20f940106261365ae123207e3c07567eebbebaa1345a5df4abdca9b64b3e781cd70d868e3bc10d9
SSDEEP

3072:OQoHogIKI05QtbYJHzcOcfr/GChz3mp9nLHeaVPdLwuL5XDg6Old:OQIoD8QtOH4OcfpmQwLwQhDg6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2084	Unicorn-2416.exe
2984	Unicorn-31798.exe
1156	Unicorn-20938.exe
3012	Unicorn-25105.exe
2872	Unicorn-10806.exe
2604	Unicorn-41441.exe
2740	Unicorn-41995.exe
2692	Unicorn-41223.exe
2100	Unicorn-57294.exe
1028	Unicorn-22749.exe
2796	Unicorn-39085.exe
2960	Unicorn-39085.exe
2836	Unicorn-19219.exe
1604	Unicorn-15135.exe
2756	Unicorn-28870.exe
832	Unicorn-41114.exe
572	Unicorn-23194.exe
2536	Unicorn-21270.exe
1232	Unicorn-49858.exe
424	Unicorn-45866.exe
1560	Unicorn-37341.exe
1344	Unicorn-37606.exe
2040	Unicorn-46329.exe
1684	Unicorn-31384.exe
1652	Unicorn-3350.exe
2212	Unicorn-53942.exe
1636	Unicorn-19132.exe
1048	Unicorn-64148.exe
2340	Unicorn-35468.exe
2180	Unicorn-12147.exe
764	Unicorn-1212.exe
888	Unicorn-37113.exe
1964	Unicorn-6941.exe
1676	Unicorn-9100.exe
3040	Unicorn-23390.exe
1772	Unicorn-62193.exe
2700	Unicorn-40189.exe
2280	Unicorn-41581.exe
2172	Unicorn-51787.exe
2404	Unicorn-57917.exe
2732	Unicorn-41351.exe
2592	Unicorn-62733.exe
2596	Unicorn-28477.exe
2600	Unicorn-40175.exe
1432	Unicorn-61150.exe
848	Unicorn-46205.exe
2820	Unicorn-5172.exe
2628	Unicorn-51970.exe
2824	Unicorn-52235.exe
2832	Unicorn-13075.exe
1064	Unicorn-3034.exe
3056	Unicorn-50189.exe
2392	Unicorn-35799.exe
1852	Unicorn-41929.exe
1920	Unicorn-41929.exe
2360	Unicorn-902.exe
2092	Unicorn-55504.exe
1908	Unicorn-9832.exe
1944	Unicorn-65063.exe
632	Unicorn-81.exe
1680	Unicorn-26723.exe
284	Unicorn-36859.exe
1764	Unicorn-22469.exe
1768	Unicorn-2603.exe

Loads dropped DLL 64 IoCs

pid	Process
696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
2084	Unicorn-2416.exe
696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
2084	Unicorn-2416.exe
2984	Unicorn-31798.exe
2984	Unicorn-31798.exe
696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
1156	Unicorn-20938.exe
1156	Unicorn-20938.exe
2084	Unicorn-2416.exe
2084	Unicorn-2416.exe
2872	Unicorn-10806.exe
2872	Unicorn-10806.exe
696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
2604	Unicorn-41441.exe
2604	Unicorn-41441.exe
2740	Unicorn-41995.exe
1156	Unicorn-20938.exe
2740	Unicorn-41995.exe
3012	Unicorn-25105.exe
1156	Unicorn-20938.exe
3012	Unicorn-25105.exe
2084	Unicorn-2416.exe
2984	Unicorn-31798.exe
2084	Unicorn-2416.exe
2984	Unicorn-31798.exe
2692	Unicorn-41223.exe
2692	Unicorn-41223.exe
2872	Unicorn-10806.exe
2872	Unicorn-10806.exe
1604	Unicorn-15135.exe
1604	Unicorn-15135.exe
2756	Unicorn-28870.exe
2984	Unicorn-31798.exe
2756	Unicorn-28870.exe
2984	Unicorn-31798.exe
2084	Unicorn-2416.exe
2796	Unicorn-39085.exe
2084	Unicorn-2416.exe
2796	Unicorn-39085.exe
2740	Unicorn-41995.exe
2740	Unicorn-41995.exe
2960	Unicorn-39085.exe
2960	Unicorn-39085.exe
3012	Unicorn-25105.exe
3012	Unicorn-25105.exe
2836	Unicorn-19219.exe
2836	Unicorn-19219.exe
2100	Unicorn-57294.exe
2100	Unicorn-57294.exe
1156	Unicorn-20938.exe
1156	Unicorn-20938.exe
1028	Unicorn-22749.exe
1028	Unicorn-22749.exe
2604	Unicorn-41441.exe
696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
2604	Unicorn-41441.exe
696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
832	Unicorn-41114.exe
832	Unicorn-41114.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2892	2500	WerFault.exe	122
3272	1508	WerFault.exe	125
3184	1356	WerFault.exe	124
5696	1904	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24864.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
2084	Unicorn-2416.exe
2984	Unicorn-31798.exe
1156	Unicorn-20938.exe
3012	Unicorn-25105.exe
2872	Unicorn-10806.exe
2740	Unicorn-41995.exe
2604	Unicorn-41441.exe
2692	Unicorn-41223.exe
2796	Unicorn-39085.exe
2100	Unicorn-57294.exe
2960	Unicorn-39085.exe
1604	Unicorn-15135.exe
2756	Unicorn-28870.exe
1028	Unicorn-22749.exe
2836	Unicorn-19219.exe
832	Unicorn-41114.exe
572	Unicorn-23194.exe
2536	Unicorn-21270.exe
1232	Unicorn-49858.exe
2040	Unicorn-46329.exe
1560	Unicorn-37341.exe
424	Unicorn-45866.exe
1684	Unicorn-31384.exe
1344	Unicorn-37606.exe
1652	Unicorn-3350.exe
2212	Unicorn-53942.exe
764	Unicorn-1212.exe
1636	Unicorn-19132.exe
2340	Unicorn-35468.exe
2180	Unicorn-12147.exe
1048	Unicorn-64148.exe
888	Unicorn-37113.exe
1964	Unicorn-6941.exe
1676	Unicorn-9100.exe
3040	Unicorn-23390.exe
1772	Unicorn-62193.exe
2700	Unicorn-40189.exe
2280	Unicorn-41581.exe
2404	Unicorn-57917.exe
2172	Unicorn-51787.exe
2732	Unicorn-41351.exe
2592	Unicorn-62733.exe
2600	Unicorn-40175.exe
2596	Unicorn-28477.exe
2820	Unicorn-5172.exe
1432	Unicorn-61150.exe
2824	Unicorn-52235.exe
848	Unicorn-46205.exe
2628	Unicorn-51970.exe
1064	Unicorn-3034.exe
2832	Unicorn-13075.exe
3056	Unicorn-50189.exe
2360	Unicorn-902.exe
2392	Unicorn-35799.exe
1852	Unicorn-41929.exe
1920	Unicorn-41929.exe
1908	Unicorn-9832.exe
2092	Unicorn-55504.exe
1944	Unicorn-65063.exe
632	Unicorn-81.exe
1680	Unicorn-26723.exe
1764	Unicorn-22469.exe
284	Unicorn-36859.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 2084	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	31
PID 696 wrote to memory of 2084	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	31
PID 696 wrote to memory of 2084	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	31
PID 696 wrote to memory of 2084	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	31
PID 696 wrote to memory of 2984	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	33
PID 696 wrote to memory of 2984	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	33
PID 696 wrote to memory of 2984	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	33
PID 696 wrote to memory of 2984	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	33
PID 2084 wrote to memory of 1156	2084	Unicorn-2416.exe	32
PID 2084 wrote to memory of 1156	2084	Unicorn-2416.exe	32
PID 2084 wrote to memory of 1156	2084	Unicorn-2416.exe	32
PID 2084 wrote to memory of 1156	2084	Unicorn-2416.exe	32
PID 2984 wrote to memory of 3012	2984	Unicorn-31798.exe	34
PID 2984 wrote to memory of 3012	2984	Unicorn-31798.exe	34
PID 2984 wrote to memory of 3012	2984	Unicorn-31798.exe	34
PID 2984 wrote to memory of 3012	2984	Unicorn-31798.exe	34
PID 696 wrote to memory of 2872	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	35
PID 696 wrote to memory of 2872	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	35
PID 696 wrote to memory of 2872	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	35
PID 696 wrote to memory of 2872	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	35
PID 1156 wrote to memory of 2604	1156	Unicorn-20938.exe	36
PID 1156 wrote to memory of 2604	1156	Unicorn-20938.exe	36
PID 1156 wrote to memory of 2604	1156	Unicorn-20938.exe	36
PID 1156 wrote to memory of 2604	1156	Unicorn-20938.exe	36
PID 2084 wrote to memory of 2740	2084	Unicorn-2416.exe	37
PID 2084 wrote to memory of 2740	2084	Unicorn-2416.exe	37
PID 2084 wrote to memory of 2740	2084	Unicorn-2416.exe	37
PID 2084 wrote to memory of 2740	2084	Unicorn-2416.exe	37
PID 2872 wrote to memory of 2692	2872	Unicorn-10806.exe	38
PID 2872 wrote to memory of 2692	2872	Unicorn-10806.exe	38
PID 2872 wrote to memory of 2692	2872	Unicorn-10806.exe	38
PID 2872 wrote to memory of 2692	2872	Unicorn-10806.exe	38
PID 696 wrote to memory of 2100	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	39
PID 696 wrote to memory of 2100	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	39
PID 696 wrote to memory of 2100	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	39
PID 696 wrote to memory of 2100	696	fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe	39
PID 2604 wrote to memory of 1028	2604	Unicorn-41441.exe	40
PID 2604 wrote to memory of 1028	2604	Unicorn-41441.exe	40
PID 2604 wrote to memory of 1028	2604	Unicorn-41441.exe	40
PID 2604 wrote to memory of 1028	2604	Unicorn-41441.exe	40
PID 2740 wrote to memory of 2796	2740	Unicorn-41995.exe	41
PID 2740 wrote to memory of 2796	2740	Unicorn-41995.exe	41
PID 2740 wrote to memory of 2796	2740	Unicorn-41995.exe	41
PID 2740 wrote to memory of 2796	2740	Unicorn-41995.exe	41
PID 1156 wrote to memory of 2836	1156	Unicorn-20938.exe	42
PID 1156 wrote to memory of 2836	1156	Unicorn-20938.exe	42
PID 1156 wrote to memory of 2836	1156	Unicorn-20938.exe	42
PID 1156 wrote to memory of 2836	1156	Unicorn-20938.exe	42
PID 3012 wrote to memory of 2960	3012	Unicorn-25105.exe	43
PID 3012 wrote to memory of 2960	3012	Unicorn-25105.exe	43
PID 3012 wrote to memory of 2960	3012	Unicorn-25105.exe	43
PID 3012 wrote to memory of 2960	3012	Unicorn-25105.exe	43
PID 2084 wrote to memory of 2756	2084	Unicorn-2416.exe	44
PID 2084 wrote to memory of 2756	2084	Unicorn-2416.exe	44
PID 2084 wrote to memory of 2756	2084	Unicorn-2416.exe	44
PID 2084 wrote to memory of 2756	2084	Unicorn-2416.exe	44
PID 2984 wrote to memory of 1604	2984	Unicorn-31798.exe	45
PID 2984 wrote to memory of 1604	2984	Unicorn-31798.exe	45
PID 2984 wrote to memory of 1604	2984	Unicorn-31798.exe	45
PID 2984 wrote to memory of 1604	2984	Unicorn-31798.exe	45
PID 2692 wrote to memory of 832	2692	Unicorn-41223.exe	46
PID 2692 wrote to memory of 832	2692	Unicorn-41223.exe	46
PID 2692 wrote to memory of 832	2692	Unicorn-41223.exe	46
PID 2692 wrote to memory of 832	2692	Unicorn-41223.exe	46

C:\Users\Admin\AppData\Local\Temp\fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe
"C:\Users\Admin\AppData\Local\Temp\fe5256cbbdd025b00070fa483ece67e07c1bb79fee2f942e67014ae223d04b8aN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22749.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35468.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62733.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe
        8⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        8⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        8⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        8⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        7⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
        7⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        8⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30617.exe
        8⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27407.exe
        8⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8632.exe
        7⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        7⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
        6⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52946.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33053.exe
        7⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1212.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41581.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
        7⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59235.exe
        8⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
        8⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        8⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        8⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
        7⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        7⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe
        6⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        7⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        7⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        6⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        7⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2445.exe
        7⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        6⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        6⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41939.exe
        5⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        6⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
        5⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53942.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
        7⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 220
        8⤵
        Program crash
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25526.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64331.exe
        6⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        7⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-81.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-81.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        6⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58597.exe
        7⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        7⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        6⤵
        
        PID:268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1590.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        5⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33769.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        6⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22726.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
        6⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51969.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21076.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        5⤵
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40401.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        6⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17872.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        6⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6686.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        5⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        5⤵
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        5⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6098.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
      4⤵
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        5⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33053.exe
        5⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
      4⤵
      PID:940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
      4⤵
      PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23320.exe
        7⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        8⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        8⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
        8⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        8⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        7⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30973.exe
        6⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe
        6⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        7⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        7⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10040.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        5⤵
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        5⤵
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60486.exe
        6⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        7⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10657.exe
        6⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43666.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        5⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16880.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37776.exe
        5⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        5⤵
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25349.exe
        5⤵
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2873.exe
        6⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23402.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        5⤵
        
        PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1155.exe
      4⤵
      PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exe
        6⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 220
        7⤵
        Program crash
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25526.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10988.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        6⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        5⤵
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60899.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
        5⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39599.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        6⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14414.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
      4⤵
      PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
      4⤵
      PID:6176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37341.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        5⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2445.exe
        5⤵
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24917.exe
      4⤵
      PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
      4⤵
      PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
      4⤵
      PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      4⤵
      PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
      4⤵
      PID:5900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
    3⤵
    PID:3456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29878.exe
    3⤵
    PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2252.exe
    3⤵
    PID:6160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31798.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31798.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
        7⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        8⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18741.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10657.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47234.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        7⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43142.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13239.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21541.exe
        7⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24392.exe
        6⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53099.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26723.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        6⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14414.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        6⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46053.exe
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13594.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52235.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exe
        6⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 240
        7⤵
        Program crash
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3244.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29712.exe
        5⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35124.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
        5⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        5⤵
        
        PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        5⤵
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        5⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
      4⤵
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      4⤵
      PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15135.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44482.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        7⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36152.exe
        5⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        6⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40189.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        5⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        5⤵
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5672.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        5⤵
        
        PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53972.exe
      4⤵
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        5⤵
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        5⤵
        
        PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15820.exe
      4⤵
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      4⤵
      PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25349.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        7⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        6⤵
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22726.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        6⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
        5⤵
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14829.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        5⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62074.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
      4⤵
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
      4⤵
      PID:6352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35354.exe
      4⤵
      PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
      4⤵
      PID:6324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34975.exe
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64128.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
    3⤵
    PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
    3⤵
    PID:2400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36859.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        7⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        7⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        6⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        5⤵
        Executes dropped EXE
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        6⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33498.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6941.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60351.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62916.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50600.exe
        5⤵
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5382.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
      4⤵
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        5⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44518.exe
      4⤵
      PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
      4⤵
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
      4⤵
      PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16247.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4412.exe
        6⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        5⤵
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
      4⤵
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3833.exe
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25526.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1969.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        5⤵
        
        PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
      4⤵
      PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18529.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
      4⤵
      PID:6440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23390.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
      4⤵
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        5⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
      4⤵
      PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
      4⤵
      PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15981.exe
    3⤵
    PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1503.exe
      4⤵
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
      4⤵
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
      4⤵
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
    3⤵
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
    3⤵
    PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
    3⤵
    PID:5736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57294.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57294.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19132.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
      4⤵
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        5⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        5⤵
        
        PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35446.exe
      4⤵
      PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
      4⤵
      PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48326.exe
    3⤵
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34560.exe
      4⤵
      PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29079.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      4⤵
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
      4⤵
      PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11591.exe
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
    3⤵
    PID:3364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
    3⤵
    PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
    3⤵
    PID:6448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57917.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5447.exe
      4⤵
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        5⤵
        
        PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
      4⤵
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
      4⤵
      PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
    3⤵
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
      4⤵
      PID:796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33498.exe
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15072.exe
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
    3⤵
    PID:5544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 240
      4⤵
      Program crash
      PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
    3⤵
    PID:1316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22726.exe
    3⤵
    PID:4320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
    3⤵
    PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
    3⤵
    PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
    3⤵
    PID:6820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28926.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28926.exe
  2⤵
  PID:880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
    3⤵
    PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
    3⤵
    PID:5040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
    3⤵
    PID:6044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33053.exe
    3⤵
    PID:6432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48422.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48422.exe
  2⤵
  PID:3240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
  2⤵
  PID:4420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
  2⤵
  PID:5160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
  2⤵
  PID:5360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16206.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16206.exe
  2⤵
  PID:6692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe

Filesize
468KB

MD5
e2adccf39eb3b0a1ae14670fb46a7fc8

SHA1
3ce57e493edac14a8f4ae7f2749120c3d2573851

SHA256
dfe0e6449785ce3305cce204f78328d4bc905527aa99dac4aeb4508eefe42be2

SHA512
77885fd911803fbc8bc1d815ca7b566cf724e6de3f5c9f5cd5348405dff08b09df939e4154df8644ef7fe47fe47a6052846d3987894abba053566842acf6e0fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35738.exe

Filesize
468KB

MD5
55b8a52669aa54f0efa29b481e508afe

SHA1
8370d1fa52d4739b0832ac4ffc9f843d4365b8d7

SHA256
1c312385af6e0a20e15258137231e4e34ed87e788f5b4d9ee96e1c7f3818cdf0

SHA512
b0ef452791ef649dbcdff3626e00058580b2c9ee709ad5fbc11b1bc9206bb9806888f2085e6b6740fb78cd79a06908a698f38be549a0b3bd6f3784d69c15f1cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe

Filesize
468KB

MD5
cd2a33c8d4a3a5ba846e6a897f840490

SHA1
358cba3775c1fd12a48b1de0538a1ae46dbcfbf4

SHA256
784c8a3b90cbea782bea6229607cda6d9f6e4c8f307ce87886a1f649800d90f8

SHA512
e04385c0aab1dc7e5d0a44d49b466159f56e27f8599649c5d01b4d0af1f636ca1eb1d1d4d9273d948cbe64fbced28996d225e35ab5c967979a0f2fcc1006cfd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40189.exe

Filesize
468KB

MD5
469d1c22722317473c7f96b696ee7d91

SHA1
2d77844eaf529d4774886b1162af98c7affb75a7

SHA256
fc3b1be72a7de7d5561a380604d058aaf5336b0e5d480a0170eb585a47dbc883

SHA512
85f223b918aa318bd09649a0b038db3d9d2995f948c2674ce3a578253acbd9533c55866439c8c61a7c75db234b52684afef7ab589c80951c6198b0081534ebc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40401.exe

Filesize
468KB

MD5
35ab8af360cab4025099e7b80817ec47

SHA1
04da61f5507cc2d803f53e94d6d7bee5761641ae

SHA256
20584f62fb14d0722768cf870255810e643712e1d5eef40bf9e9a23f62ecdd10

SHA512
fa88ff79669ba179fe7610f2d4f883db45bff5a788ce998aea892c3a9ee1e8e9e120afb6a5ec4c86c06e73ea00f7e0bc5f0a7d8ba37c88935ed0481794d2dd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe

Filesize
468KB

MD5
f501e66da41d43bb9b4e0d583d0374bb

SHA1
14122e2e8032574979be59798dbec1d1025ddf6b

SHA256
9fcb8367c807c253caf4bb29b81bbaa1bf747dc217dabea1c6d3a28253192f73

SHA512
b937b31f30f24684da6e1db5bd6dc40477bcdcea99be8bff8a11bb60cf6108522207f283fd2a97d73a78f5f43e48dfc3f6348686767fd9d55fcfd0f11f92f4b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5447.exe

Filesize
468KB

MD5
66041acb3eb2f98b20b7104d32e7a7e3

SHA1
123e17e79c83e8f555c18524021cc7109ace346f

SHA256
bc23c5b9b1274ee52caaafab1c66963b81e04d241afad65461404ae773fd3893

SHA512
28f7e15a8660d660fd5f61d0745ec763600074cab086c5427c6a6ebfce599a692fd98334ddcc27f4a52e74a5811fac1ecfbefd7b574d2d48ec60f13e308a2fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe

Filesize
468KB

MD5
700eeb23d2e1a812e20cf185b9ec0d2e

SHA1
7ab4d46d5bbcbdaa9120251b374b032197bcf21b

SHA256
c28163850f7cf84f5b4a7b02eab6a5a87c56a9ac98ca4c0e55899f31ef94d4dc

SHA512
af8638b4a8ebba02a5df72e0d1b196968c7196ffef1244e701521943bb1da6c75a75d9ed1eb7f480159dbb54646c85b1ba68edffeddebb541723827cce6bb5a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe

Filesize
468KB

MD5
07644d8c4da4182c231222c968b5b680

SHA1
7b261d9636b7eeb5c7d4d17538df108f9c7ba68e

SHA256
c0bf4de75306a18181993b5172554007394a98644991d41eb8bfd478c6582686

SHA512
5641b57b576aab32897a2645fc63ffe39d9faff34b3a284255d9b00a693e2a4cdf0de0aa011f48489303574dca894a2799f77ed9f2eb77a181a63f553ad34027

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe

Filesize
468KB

MD5
2d9842c6eaee4f5a9f0d402b36729edc

SHA1
d6651f6bc4d58ddef87d9505d6801bcc1daf8a89

SHA256
47bd27a9e157a7f1a9fe452aa458fff94a63f5571b3e9cb3795ed4522689bb33

SHA512
9db8e6c8c9fe279e9365cd2e45a622ba476ffa8de0b472a17adac19fee7807c6f79bfba5678dd3f121da237f7f2bd9bbc2302973fe01d6ff62ac9f5ea611f2c6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15135.exe

Filesize
468KB

MD5
ca8a0ffd4b557ab839e9fce0f3ed3337

SHA1
95203d25f6b93477c0c5dd1805a5fe0b0b42749a

SHA256
d7232d92482dd0af75909334f15e8d950501aa33516c21ef6558506316f350b1

SHA512
b12859bc926e68a9f9fed56c65213624b1f2e61bf947dab0e0613d1cc9709c403031739e66ae6ab602fc5c9f67df595d624372a16b45f87b3a7d4bca4b9d943b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe

Filesize
468KB

MD5
b7a028b58532005b428a22e852986a15

SHA1
4f7c193ea67ccf529d5c5bfa617a5de5e8771121

SHA256
8f9520fb1a28e963a7e3317ccaa3445655fcd030b4da7d22318fb81564509cec

SHA512
e71daff27e129c665c7c84160f4277b86ba36be63d3109734425372806a95a87be2b5ace41dcca132123f42e9c3bf8a93d5610c1bb8a4cbe77e7bf14394e3615

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe

Filesize
468KB

MD5
8e4580c22b028230d3333e6fbca8aa0c

SHA1
626bc3d1a5e3f7c299504e6dec3b4462b968174b

SHA256
52ec3b85de9da8261ce4d1759c6082f2bcd3e51bab1807abde40dce4d033f1e3

SHA512
5aca8a0ac893da5bf634b5817997fcd35a084f8f3dd28cf9a8d7059189b6f9bc04c2358f7b38de14a95aed0f56083451148680784aa178f8e0f0577d20886d79

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe

Filesize
468KB

MD5
330f1d974151be1810b8133135f679a1

SHA1
9cfcf44c574447968472070124ebcb5b4f1a04a7

SHA256
8abecd3f38d6bfdc78181a24323eb50bb453def6a78ddfd8d7e43542703e0a33

SHA512
fd220ba0ac5b9571741164efa53ed6bfc8a718e6e63f6ba701cf9a59ea6dc2f32659f53605cd91ddbd4f375807487b6dd4f78b75737824ebba1017558acca22a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22749.exe

Filesize
468KB

MD5
928ced6506f752a5f473b959651cd3cb

SHA1
5ae96c2e7f79ed41663ffb122a34e15ada25f325

SHA256
0e61a11342dc1f875609269f9469bcb1581b07489fb25a729dbe3cbbc613ca80

SHA512
8fd648167f179589db8213308f1de5e9b398393714e7f1802fbbe661f2023791efa30a2f300715ba39adfd15bf528a1de85057badf7fa945dfadc335199aa07a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe

Filesize
468KB

MD5
77f4b72867a4debfe8ebfd7ddea98b14

SHA1
22b480767ea806ba76b48831c6e3db1947a8e7ee

SHA256
5f821dffafe2c03781207ad71f88326da6173e1db1b746c01c4c405cb5e19511

SHA512
b31f9649002030322e108f4c56b2c1b83cc9b9bfe26a6f3892db231973b83d6dde69ca61e3043a1c0cf3f9dae1f6dcf0e6a2ab3536f7ae802d3992af0471b5c0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe

Filesize
468KB

MD5
a8713e66d7bb3965b67922d34a3698ba

SHA1
b39cf7c0055ce4a68db561b025134b9a1b47ffd9

SHA256
1b8cbf0ed3f7edcb7ce1b58c8382a6a39b9b846580d4b49e2a61be6779ba92f3

SHA512
9dd8ed0185596ac69cd7b2273c4ecca92b7740b2b7871943fe1a48c092bcdc056019f06b5f7db84537810f2f20a3dc5bd125fa6c5e182a1e76480dd92f053e0f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe

Filesize
468KB

MD5
6cdaccd76cc4ccc9fa81cbcfba6c285e

SHA1
0575492632bfcecef26b55692665b03b66c82f05

SHA256
fd82773b6c2ba7ff0db4bcf2b18c51cb8a09c60a968785f9bbc788aa9d3280f9

SHA512
d0797cad53b60cb75e7291d7a30a737fc9cc8691dfc79a5378bef4c8600c95301628b9cdc5552b29cb4bf846caaab8d9067d89d8634f1ce0048c54b72cb43e8d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31798.exe

Filesize
468KB

MD5
6bebbd2fa5729b0c3cb754a37770b6c8

SHA1
69fd1c2c8432e85694d7b7a0f7af6e3607eb9b79

SHA256
ea1812a933f092270a7ed91750eaf723ae5f634add2300c361b21666a37060ad

SHA512
4044c5b0f1e9fc065296ab7572f8c918ebc314c6c0db333aaa782afe7b64792e816cf937288e29f47ca0da59ed28041ee5463e3c3f0e25c920b7fb7f34e615bd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe

Filesize
468KB

MD5
4a6752ad66f0bbdf59ba35a739ee28a3

SHA1
c46abe131ea9b8b1a0dd73e5ccfe5507d210468a

SHA256
b5ef3e974e351a3b0bdf209927567dda2abf1782cd82742d1a2ac6155738238c

SHA512
6053be22dc9d0669b7708b9a29d19f5e001f87c87423800222f59c264c11ca5d8de5804d429ccd73be13e0d7a7663d6c4bd06ff40661625691d1345a660f5d7b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe

Filesize
468KB

MD5
4fcbb98072f044aee92d8e3055a7b79b

SHA1
e10a647fc816474e6dca711f60948f1440c32fdd

SHA256
f255ed627313acecc9d53f80e0031de8823c9c830f281288dd20b9a13ad4cc8d

SHA512
ad6a07921acf4cf54cde81f7a005f9e772f90dc56bd9cc05a6e5b1e074e5bf3d465502fa6c8b48e78387bfb329fc6b91fdc5b8f8376d60173ead3b2a680b0857

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe

Filesize
468KB

MD5
4f02e34603e75c1dbd0d7f82dfc1f983

SHA1
8d4c22549eff94e18de4b272d8f34d6b4997369c

SHA256
184ac629f7fbca403479d89711d47eb85a75501db6dba39d3efe86bd8f1cdb93

SHA512
75994c47e171f243265f27f3c76d4b26401bc1a98f9a013e463ce50e7397b9038eea64ae71b59d899344385ad6a3918cbd04df306a367adbc77a3f55e97575b4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe

Filesize
468KB

MD5
19cfa3214265f054d90a5fd92dbbf025

SHA1
35c7b5b4c149e7f0cb2df93f7d65979d057f257b

SHA256
3cbb9837ecb725a34e924f7114cde08f4f096177449b0368b015dd7dd736de5e

SHA512
5c31e93e1ad6f795993e8f0d6768e024fbe287ee84cda490ebd5e15cb72e8a9dcb1358eea975ea2c77ff657d2c49afbd084c5cb60497dcdb57f00a1e5003c47a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57294.exe

Filesize
468KB

MD5
044c3111cacc9e818468b01b2c1af995

SHA1
2f5c05e9662d377cac70669ded1255e35f5d5fbc

SHA256
3595dc447c75e933577852e1d3f5619ed85006e471fa7d7c761df384c714daf8

SHA512
3a1970eeb7f4b5493ec91d2a22020a06adb4b6a64bb50cc43ee4c54466c600e6a1f53ee4f9702b82356626885d01db23cdec4775416ed094d31aa4cd1ea642c9

Download Submit