0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405

Analysis

max time kernel
115s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
Size

468KB
MD5

b6df746ac4c4e6ad21250600d940aab0
SHA1

4826d6154284da29449e76fa50701c4fa3a2c872
SHA256

0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405
SHA512

736adbbbfe309f99c24745005153b204358210a95db892ba0fe9397d3d7d5d70a21dfcd727e928237fd74cde5f54d9ad5c04005d0b062efb4b150eac8e2f50a9
SSDEEP

3072:HNzeoguxjaTU3b85Pz3xOf8/OChP0kx/emH48/HKSpn+3UPNAPq2:HNioZsU3ePDxOfrwG3Sp+EPNA

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2980	Unicorn-55603.exe
2732	Unicorn-36143.exe
2028	Unicorn-47004.exe
2700	Unicorn-3361.exe
2832	Unicorn-63423.exe
2860	Unicorn-17752.exe
2556	Unicorn-7537.exe
2176	Unicorn-36309.exe
1764	Unicorn-43085.exe
2024	Unicorn-40969.exe
2532	Unicorn-6158.exe
2868	Unicorn-18502.exe
1612	Unicorn-4767.exe
2960	Unicorn-24368.exe
908	Unicorn-34013.exe
768	Unicorn-42273.exe
1312	Unicorn-28537.exe
1296	Unicorn-48403.exe
2220	Unicorn-3649.exe
568	Unicorn-23515.exe
1096	Unicorn-23515.exe
1592	Unicorn-23250.exe
1656	Unicorn-14584.exe
2428	Unicorn-34296.exe
2500	Unicorn-20561.exe
1876	Unicorn-40427.exe
2328	Unicorn-27874.exe
2008	Unicorn-28428.exe
2788	Unicorn-13483.exe
3000	Unicorn-21551.exe
2508	Unicorn-27682.exe
2708	Unicorn-54059.exe
2828	Unicorn-48849.exe
2680	Unicorn-18122.exe
2844	Unicorn-48849.exe
1696	Unicorn-3177.exe
2864	Unicorn-54800.exe
2248	Unicorn-1615.exe
1332	Unicorn-54443.exe
1552	Unicorn-19898.exe
2140	Unicorn-32241.exe
844	Unicorn-41640.exe
2936	Unicorn-61506.exe
2284	Unicorn-61506.exe
2388	Unicorn-64199.exe
664	Unicorn-17136.exe
3048	Unicorn-37002.exe
328	Unicorn-37002.exe
1728	Unicorn-46354.exe
1272	Unicorn-29818.exe
2624	Unicorn-30095.exe
1800	Unicorn-63514.exe
2380	Unicorn-23873.exe
2332	Unicorn-18205.exe
2300	Unicorn-63243.exe
1868	Unicorn-36509.exe
2800	Unicorn-5682.exe
2692	Unicorn-57484.exe
2792	Unicorn-11812.exe
2656	Unicorn-65097.exe
3060	Unicorn-47946.exe
2592	Unicorn-2274.exe
1936	Unicorn-28816.exe
2724	Unicorn-21111.exe

Loads dropped DLL 64 IoCs

pid	Process
2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
2980	Unicorn-55603.exe
2980	Unicorn-55603.exe
2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
2732	Unicorn-36143.exe
2732	Unicorn-36143.exe
2980	Unicorn-55603.exe
2980	Unicorn-55603.exe
2028	Unicorn-47004.exe
2028	Unicorn-47004.exe
2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
2700	Unicorn-3361.exe
2700	Unicorn-3361.exe
2732	Unicorn-36143.exe
2732	Unicorn-36143.exe
2556	Unicorn-7537.exe
2556	Unicorn-7537.exe
2860	Unicorn-17752.exe
2860	Unicorn-17752.exe
2980	Unicorn-55603.exe
2980	Unicorn-55603.exe
2028	Unicorn-47004.exe
2028	Unicorn-47004.exe
2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
832	WerFault.exe
832	WerFault.exe
832	WerFault.exe
832	WerFault.exe
832	WerFault.exe
832	WerFault.exe
832	WerFault.exe
1764	Unicorn-43085.exe
1764	Unicorn-43085.exe
2176	Unicorn-36309.exe
2176	Unicorn-36309.exe
2732	Unicorn-36143.exe
2732	Unicorn-36143.exe
2700	Unicorn-3361.exe
2700	Unicorn-3361.exe
2860	Unicorn-17752.exe
2960	Unicorn-24368.exe
2860	Unicorn-17752.exe
2960	Unicorn-24368.exe
2532	Unicorn-6158.exe
2532	Unicorn-6158.exe
2980	Unicorn-55603.exe
2980	Unicorn-55603.exe
2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
2556	Unicorn-7537.exe
2028	Unicorn-47004.exe
2024	Unicorn-40969.exe
2556	Unicorn-7537.exe
2024	Unicorn-40969.exe
2028	Unicorn-47004.exe
908	Unicorn-34013.exe
908	Unicorn-34013.exe
1764	Unicorn-43085.exe
1764	Unicorn-43085.exe
1312	Unicorn-28537.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
832	2832	WerFault.exe	35

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8527.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
2980	Unicorn-55603.exe
2732	Unicorn-36143.exe
2028	Unicorn-47004.exe
2700	Unicorn-3361.exe
2832	Unicorn-63423.exe
2556	Unicorn-7537.exe
2860	Unicorn-17752.exe
2176	Unicorn-36309.exe
1764	Unicorn-43085.exe
2532	Unicorn-6158.exe
2024	Unicorn-40969.exe
2868	Unicorn-18502.exe
2960	Unicorn-24368.exe
1612	Unicorn-4767.exe
908	Unicorn-34013.exe
1312	Unicorn-28537.exe
768	Unicorn-42273.exe
1296	Unicorn-48403.exe
2220	Unicorn-3649.exe
568	Unicorn-23515.exe
1592	Unicorn-23250.exe
1876	Unicorn-40427.exe
2428	Unicorn-34296.exe
1096	Unicorn-23515.exe
2500	Unicorn-20561.exe
1656	Unicorn-14584.exe
2328	Unicorn-27874.exe
2008	Unicorn-28428.exe
2788	Unicorn-13483.exe
3000	Unicorn-21551.exe
2708	Unicorn-54059.exe
2828	Unicorn-48849.exe
2844	Unicorn-48849.exe
2680	Unicorn-18122.exe
2508	Unicorn-27682.exe
1696	Unicorn-3177.exe
2864	Unicorn-54800.exe
2248	Unicorn-1615.exe
1552	Unicorn-19898.exe
1332	Unicorn-54443.exe
2388	Unicorn-64199.exe
3048	Unicorn-37002.exe
2936	Unicorn-61506.exe
2140	Unicorn-32241.exe
664	Unicorn-17136.exe
328	Unicorn-37002.exe
2284	Unicorn-61506.exe
844	Unicorn-41640.exe
1272	Unicorn-29818.exe
1728	Unicorn-46354.exe
2624	Unicorn-30095.exe
1800	Unicorn-63514.exe
2380	Unicorn-23873.exe
2300	Unicorn-63243.exe
1868	Unicorn-36509.exe
2692	Unicorn-57484.exe
2792	Unicorn-11812.exe
2800	Unicorn-5682.exe
2656	Unicorn-65097.exe
3060	Unicorn-47946.exe
2592	Unicorn-2274.exe
2724	Unicorn-21111.exe
552	Unicorn-6166.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2980	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	31
PID 2340 wrote to memory of 2980	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	31
PID 2340 wrote to memory of 2980	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	31
PID 2340 wrote to memory of 2980	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	31
PID 2980 wrote to memory of 2732	2980	Unicorn-55603.exe	32
PID 2980 wrote to memory of 2732	2980	Unicorn-55603.exe	32
PID 2980 wrote to memory of 2732	2980	Unicorn-55603.exe	32
PID 2980 wrote to memory of 2732	2980	Unicorn-55603.exe	32
PID 2340 wrote to memory of 2028	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	33
PID 2340 wrote to memory of 2028	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	33
PID 2340 wrote to memory of 2028	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	33
PID 2340 wrote to memory of 2028	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	33
PID 2732 wrote to memory of 2700	2732	Unicorn-36143.exe	34
PID 2732 wrote to memory of 2700	2732	Unicorn-36143.exe	34
PID 2732 wrote to memory of 2700	2732	Unicorn-36143.exe	34
PID 2732 wrote to memory of 2700	2732	Unicorn-36143.exe	34
PID 2980 wrote to memory of 2832	2980	Unicorn-55603.exe	35
PID 2980 wrote to memory of 2832	2980	Unicorn-55603.exe	35
PID 2980 wrote to memory of 2832	2980	Unicorn-55603.exe	35
PID 2980 wrote to memory of 2832	2980	Unicorn-55603.exe	35
PID 2028 wrote to memory of 2860	2028	Unicorn-47004.exe	36
PID 2028 wrote to memory of 2860	2028	Unicorn-47004.exe	36
PID 2028 wrote to memory of 2860	2028	Unicorn-47004.exe	36
PID 2028 wrote to memory of 2860	2028	Unicorn-47004.exe	36
PID 2340 wrote to memory of 2556	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	37
PID 2340 wrote to memory of 2556	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	37
PID 2340 wrote to memory of 2556	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	37
PID 2340 wrote to memory of 2556	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	37
PID 2700 wrote to memory of 2176	2700	Unicorn-3361.exe	38
PID 2700 wrote to memory of 2176	2700	Unicorn-3361.exe	38
PID 2700 wrote to memory of 2176	2700	Unicorn-3361.exe	38
PID 2700 wrote to memory of 2176	2700	Unicorn-3361.exe	38
PID 2732 wrote to memory of 1764	2732	Unicorn-36143.exe	39
PID 2732 wrote to memory of 1764	2732	Unicorn-36143.exe	39
PID 2732 wrote to memory of 1764	2732	Unicorn-36143.exe	39
PID 2732 wrote to memory of 1764	2732	Unicorn-36143.exe	39
PID 2556 wrote to memory of 2024	2556	Unicorn-7537.exe	40
PID 2556 wrote to memory of 2024	2556	Unicorn-7537.exe	40
PID 2556 wrote to memory of 2024	2556	Unicorn-7537.exe	40
PID 2556 wrote to memory of 2024	2556	Unicorn-7537.exe	40
PID 2860 wrote to memory of 2532	2860	Unicorn-17752.exe	41
PID 2860 wrote to memory of 2532	2860	Unicorn-17752.exe	41
PID 2860 wrote to memory of 2532	2860	Unicorn-17752.exe	41
PID 2860 wrote to memory of 2532	2860	Unicorn-17752.exe	41
PID 2832 wrote to memory of 832	2832	Unicorn-63423.exe	42
PID 2832 wrote to memory of 832	2832	Unicorn-63423.exe	42
PID 2832 wrote to memory of 832	2832	Unicorn-63423.exe	42
PID 2832 wrote to memory of 832	2832	Unicorn-63423.exe	42
PID 2980 wrote to memory of 2868	2980	Unicorn-55603.exe	43
PID 2980 wrote to memory of 2868	2980	Unicorn-55603.exe	43
PID 2980 wrote to memory of 2868	2980	Unicorn-55603.exe	43
PID 2980 wrote to memory of 2868	2980	Unicorn-55603.exe	43
PID 2028 wrote to memory of 1612	2028	Unicorn-47004.exe	44
PID 2028 wrote to memory of 1612	2028	Unicorn-47004.exe	44
PID 2028 wrote to memory of 1612	2028	Unicorn-47004.exe	44
PID 2028 wrote to memory of 1612	2028	Unicorn-47004.exe	44
PID 2340 wrote to memory of 2960	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	45
PID 2340 wrote to memory of 2960	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	45
PID 2340 wrote to memory of 2960	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	45
PID 2340 wrote to memory of 2960	2340	0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe	45
PID 1764 wrote to memory of 908	1764	Unicorn-43085.exe	46
PID 1764 wrote to memory of 908	1764	Unicorn-43085.exe	46
PID 1764 wrote to memory of 908	1764	Unicorn-43085.exe	46
PID 1764 wrote to memory of 908	1764	Unicorn-43085.exe	46

C:\Users\Admin\AppData\Local\Temp\0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe
"C:\Users\Admin\AppData\Local\Temp\0023d39ff50a958de6ebc5a79fe985afba6c6f2b32ddb4c44f487b31d8674405N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55603.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55603.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36143.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36309.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48403.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        7⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61625.exe
        8⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17169.exe
        9⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
        9⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        8⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        8⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25007.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
        8⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12435.exe
        8⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62486.exe
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        8⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62557.exe
        7⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        8⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        8⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        8⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16074.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        7⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12492.exe
        7⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27624.exe
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15258.exe
        7⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65320.exe
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3749.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37917.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28537.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13483.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11812.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18715.exe
        8⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        8⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
        8⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15258.exe
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
        8⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8963.exe
        7⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        7⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
        7⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        7⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44760.exe
        6⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        7⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56446.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        8⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        8⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        8⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exe
        8⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36845.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        8⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
        8⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        8⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52989.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-76.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-76.exe
        7⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        7⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        7⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        7⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
        6⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23873.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
        7⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41936.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39464.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63243.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        6⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12295.exe
        7⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        5⤵
        
        PID:108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30199.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60216.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
        5⤵
        
        PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42273.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        6⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        7⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47717.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        6⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13519.exe
        5⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        5⤵
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43006.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31704.exe
        5⤵
        
        PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58501.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54059.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        5⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
        5⤵
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        5⤵
        
        PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe
      4⤵
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
        5⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exe
        5⤵
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
      4⤵
      PID:972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
      4⤵
      PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
      4⤵
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
      4⤵
      PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65097.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        6⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19845.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3041.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
      4⤵
      Executes dropped EXE
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
      4⤵
      PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34340.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10029.exe
      4⤵
      PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52250.exe
      4⤵
      PID:1392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23250.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        5⤵
        
        PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        5⤵
        
        PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2912.exe
      4⤵
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39130.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        5⤵
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52989.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3447.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59686.exe
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46354.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
      4⤵
      PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
      4⤵
      PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62486.exe
        5⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        5⤵
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7531.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
      4⤵
      PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31245.exe
    3⤵
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exe
      4⤵
      PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
      4⤵
      PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
      4⤵
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
    3⤵
    PID:2596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13340.exe
    3⤵
    PID:4188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
    3⤵
    PID:4436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
    3⤵
    PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47004.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47004.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17752.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23515.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45336.exe
        7⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe
        8⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        8⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        8⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1666.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11272.exe
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62456.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58402.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        7⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5393.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10159.exe
        6⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5920.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17136.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31138.exe
        6⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20552.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        7⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        6⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        6⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25007.exe
        5⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13477.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
        5⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
        5⤵
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3177.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        7⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        8⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        8⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58402.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43.exe
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        6⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48232.exe
        7⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23508.exe
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51382.exe
        7⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31898.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38175.exe
        6⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
        7⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        7⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34126.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        5⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        5⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        5⤵
        
        PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        5⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44204.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        5⤵
        
        PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
      4⤵
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47962.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
      4⤵
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54035.exe
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
      4⤵
      PID:6304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4767.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        6⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        6⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52217.exe
        5⤵
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6066.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
      4⤵
      PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-241.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65245.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
      4⤵
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10634.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64023.exe
        6⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64578.exe
        5⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
      4⤵
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9393.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19273.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44288.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
      4⤵
      PID:6216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        5⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        5⤵
        
        PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32782.exe
      4⤵
      PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
      4⤵
      PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
    3⤵
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
      4⤵
      PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
      4⤵
      PID:6256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40394.exe
    3⤵
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
    3⤵
    PID:6176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40969.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
        6⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        5⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43406.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6593.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
        5⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12767.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29658.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        5⤵
        
        PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
      4⤵
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        5⤵
        
        PID:584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55206.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
      4⤵
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17440.exe
      4⤵
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41164.exe
        5⤵
        
        PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
        5⤵
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26673.exe
      4⤵
      PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10194.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
      4⤵
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
      4⤵
      PID:5564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31138.exe
      4⤵
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        5⤵
        
        PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55974.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38423.exe
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
      4⤵
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
      4⤵
      PID:6624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
    3⤵
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
      4⤵
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
      4⤵
      PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23873.exe
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
    3⤵
    PID:4180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21197.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23515.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe
        6⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2068.exe
        6⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8527.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1666.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40929.exe
      4⤵
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
        5⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        5⤵
        
        PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47286.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46018.exe
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
      4⤵
      PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
      4⤵
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9393.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52989.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44288.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23389.exe
      4⤵
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
    3⤵
    PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55850.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10385.exe
      4⤵
      PID:6880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
    3⤵
    PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
    3⤵
    PID:5828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14584.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14584.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33193.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        5⤵
        
        PID:300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31367.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
      4⤵
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26181.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
    3⤵
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63841.exe
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
      4⤵
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
      4⤵
      PID:6152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
    3⤵
    PID:5468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18550.exe
    3⤵
    PID:6436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29818.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29818.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
    3⤵
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19099.exe
      4⤵
      PID:320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
      4⤵
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
      4⤵
      PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35714.exe
    3⤵
    PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
    3⤵
    PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
    3⤵
    PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
    3⤵
    PID:5944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exe
  2⤵
  PID:1580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
    3⤵
    PID:4308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
    3⤵
    PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
    3⤵
    PID:5904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45524.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45524.exe
  2⤵
  PID:3848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
  2⤵
  PID:4796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35604.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35604.exe
  2⤵
  PID:3008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23380.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23380.exe
  2⤵
  PID:5296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-4767.exe

Filesize
468KB

MD5
4e40e977b3c76120107729820f710daa

SHA1
026d494c76dcfa69b1fa287bad585b2076e1d6c0

SHA256
a819456bc2fed86b3073fe91c493c1be7e55e490851f9533931f23093c9146d5

SHA512
32015ec580d957cfe193ee044e5c2366d9b8d2b7f8e4f51af7ec5882e95462dba66a1dd7de2d9fe5ac2db4e6b5dea15eb221aa27a88ffcf038c49f0f991b274f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe

Filesize
468KB

MD5
97f3188709f3de9800f0dff61da2760d

SHA1
418f396bd6a90d30463110c8ecd76e7f9dcfe173

SHA256
4d4bb18424e603c360c470648d7105b87d6b5d9aa82dfe9cf5ffd4ddd0447bf6

SHA512
94f2fcc0bf8bfc442b2c352f3a027df8fb7d994c435b2c39ee9499bf70111f15d223f9224b262aad435933b802fc2cb89ab3356e709e12ce39b06a207568e40f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe

Filesize
468KB

MD5
c6228b025dee192e5f58fc7c1023450c

SHA1
93263cff7992b96a91e167014354f2121835aa86

SHA256
e5c97e337fbe8395be570f65f82f148fc7481911f5c685784c584e7764b9178b

SHA512
aec1dda43fc3bcb8eb87dafa1ae717614c4c5c058a43b972021cd1b823c896459fb295b3bdd008034d172e8a96c6696ea9a5a27fdaa2c57e94fd789baf9dbd12

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17752.exe

Filesize
468KB

MD5
1f7d52a3e720566aada365771e6eb745

SHA1
9cc4d9bcd0fb61ecc9ad62804a901f098ffef662

SHA256
52c01131133743c31c78f6ba1d213f6b39c515714e1517a0113a499b37226e82

SHA512
9cdf4cc6b13a4107cb87f1a21f20eac6bac883220586c300f297b72ea4f18265c9aeab271539eb817a2a0b97457770922dc25a5c17ea892d1631ccc621535459

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe

Filesize
468KB

MD5
2df6e7a76423edc6eda4a24563adb961

SHA1
a397abfbfe6087272648ce268bf2cf8b5f45673c

SHA256
4376da082a60f4419160f9dbe1daddaa1e4f72abe72b2214fa8f7bf6b7c55581

SHA512
e4d59aca02f093b8b1982a1ba56d6d496e5c304abfb7ffbf8b43d3416d83863dc27b52fbfe00f89eaeb1bfc8553e4203bbb67e37c177fb3802408ea1c32a2207

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe

Filesize
468KB

MD5
c5cc4474c1415b9adef78a624598021b

SHA1
6197e4e8981ffbfc4576bd19ddc8d1092474d429

SHA256
30055e369bc159441c64afcc2d63fe4018342ce1329cc1d41a9d4616926545b1

SHA512
3e31f260b5c5dffcb3be373c64c4e0a697689753c1ea1480379f1244f4893bcb3efe996f8499f4ce7272ad2a1fa91cd70c1bbb788c7f482b2f984808e8f27650

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe

Filesize
468KB

MD5
1123205605f176bd8e05c547964923ad

SHA1
6c5bf301021cfcf2b0d03d8b982d99cc227964e4

SHA256
0aaf78986c0555ad0918767efb6e7f952e5aaef2a89861be13ff48ba1bd34645

SHA512
3f7d73ce44561a865b3926c9a367209aba125a2c01b70885a72bbf0b9f5cbb6df7c4124db18702cd38a8ce4c0d6d3ff12a7ec0ee558b49c2ba36048ad680d177

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe

Filesize
468KB

MD5
ceeccdae66a239f1e1997a6333549c67

SHA1
a8d2a7db9f074ba1daac70d4b64b3ace23f9072e

SHA256
39f8f97929d942ff6b33682f2577e529dbcb1ee999b49f5d493c4b694dcab0bc

SHA512
5aff4dd4d4b07e1d7528c24ba0ac751842afcc128fb9fdc6b12a682dfefbc60a95298a08d0a78b4711a48017ce309e2c6a190d1ebad3131cb848dd222009aabf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36143.exe

Filesize
468KB

MD5
691521d03b6bb00574caa63bd4974bd7

SHA1
4d9c2e155e2e769f0d75659210e04533276f101f

SHA256
5d353b873afbeb2bc8b401c40201da11e7774b995982a234d1586fc061e996ce

SHA512
1b4eafcdb62616b51901af27c3278402164bed4ce2a7ab71fe46bbccc58f8a77f111ca1cb5bd3c4639bbd93a66e517f3a6009a80eb07a1170137f5c645963e64

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36309.exe

Filesize
468KB

MD5
ca0bd14b5d7b501c35deb80ae55402e6

SHA1
07fba9e50e2742f3d59b3886343359fc8831a5ef

SHA256
a733205b341d27d62edbacf7f74b5eb2384075589159717b08d2316a413fd5d6

SHA512
d1c79d370322ed95dd0e58aa8ea63b7722755675af84f01502d8d87145734fac0515146301e42ba0e0a9ddd54c3842cf29d7143b30be31714d41051bafd2dd34

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40969.exe

Filesize
468KB

MD5
26cb0a588b1eae65657663d5a5ed0b71

SHA1
0fb94161766715d1d48ec2f163be410a1d5fb4bc

SHA256
9890ceb74e9672ab9e4a2ef5d05fa79c9b1c088ecb4934609cdab9cc95237343

SHA512
88faff47991d2012b800fd48cceee793aba0f047cde9a1fab53fcd0ee873bc2adeb8c7520b0d228b40cab71db0085b3aa4055587b50ed6f5ae322bc4603d613c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42273.exe

Filesize
468KB

MD5
d351959d49208b7966e8e39139d5c942

SHA1
1d2f13b4213fb5b817390cdfae5ccff4b60809c1

SHA256
654a59babe5499d4dab061f0d13dcd8310bffb432b1cdbb0896c31084952f989

SHA512
82f05f4fdb8137fab08b84d4aee50d4f0c0dd73b6db55ce7c2de2ce6e4f3504c82d64a9dce3ebdce1e88fa0d13ff01c3ae8bce2b01fd09dc2f63f302faeed36a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe

Filesize
468KB

MD5
a44197c9e3cfdbead0e48cfa56361c67

SHA1
6430029009a796a64b75d3d5358ad411bb46d476

SHA256
dc45ee851963ce25e394e0b0cd41f8cea757e6658753f604667e001b34cdfff5

SHA512
fdb2f718a15195562b879cbf6ab90c1eb512385f3d7bae97d1ebb2c93ed87de36a69b9dbcfb070fedf673ad50d129c307112be67532e40d83509a23da158d8da

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47004.exe

Filesize
468KB

MD5
f206f64caee4c1da3b174fe20c1ce518

SHA1
6995cdfeb4a2f3a18b53606072614cc9262eed9b

SHA256
5043d44d87ac89e6b47858519a1f6c8d2b4b2aecc0c7def6e6f1887ae7232c7e

SHA512
e3d922591814c5cde80f9bc13bc1ac55e17e8a1b6acf1c0416c203a912a9215f998af66ec4f4e20b6859c41f41066b136c2e764e06f6b9fc634206cba3d96b5d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48403.exe

Filesize
468KB

MD5
1470dce30cc04b6f829220e304ded669

SHA1
a1bd76f0dee13c1e14f79b8589b565e8696ea565

SHA256
462b59f529fe8b84bb0641656442b0c8e5e23ee00e19cf454aa1f92a4bf8e785

SHA512
9a5080b0e290a888f1368e9ab049bd3ddd5bca1815c16ed35f6f4ea2c227cd2dc30c7654a0bf81ddb5f628cf4bd4ca051826a48203e111085701f2e343687ba9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55603.exe

Filesize
468KB

MD5
79dd48cab15f59cf2fcf801bfe00842e

SHA1
75f78abefa151116ae7fd36227c9f73ca6588d41

SHA256
3035904d01167451d3467440e1018e12e78a8c6cedb98186c346d730f7218ba4

SHA512
e576f964c7118a7c6c01e6e064a115368c43164623dddc256bd10dad8f8bf27eb9b7c8adeaf03f586cdac9b77d662a60dd64e11819d81cbe0d8ee9079f7e48ce

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe

Filesize
468KB

MD5
02e9b6fa728833d177110c586491430c

SHA1
a596d6c41a42a9c3632c26b5b0b989859e95370b

SHA256
771f0433cfc91529f22b211e2fe26ac7e4bdb01d9a7957ba4d97e364eeb5aca3

SHA512
0c0ed6aa5224886a36bf153aab8dfe515cccdc80df264db378bc9d03104715c4a84b75034f453c0ada2cf83f4af71ad17e8e52cfa106706c0b0810217cbfc2ad

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe

Filesize
468KB

MD5
5630ccbb459762e0d90988bcbcd12adf

SHA1
4ffbcc8f26cd68f4c64f623db6b1ac6cc5f00bac

SHA256
676d629f14f90305f3a83b20d6785ffcc22d90a4112f02435132657bf66ef73e

SHA512
62bc83d1e2865857a742e32cce8e15763559545df91988ac4fc249f0aa33363fb874f5a9cae14258117ed691f1af617ad72110a1723f3ef4d3996688473f799a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe

Filesize
468KB

MD5
edff0cfd9f298c122701656a9caf1f74

SHA1
ea23192f563f83a3a36aad3e2962b4ce7497430b

SHA256
3947e000c05f6c12d61f1011583b9671c99a499997b3a95cc19016cc87362cf3

SHA512
81ecedbcd80840644d9d1436f8a50258c07c13cf74aa627a8bc4fae8b9a93d0cf656b4a01e2a11b8e0aed3cf1d949a5831d2fc56823b19689cd678407fbaa684

Download Submit
memory/568-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-347-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/768-345-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/908-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/908-311-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/908-310-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1296-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-330-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/1312-332-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/1332-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1612-366-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/1612-364-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/1612-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-320-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1764-192-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1764-322-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1764-191-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1764-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1876-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-286-0x0000000000580000-0x00000000005F5000-memory.dmp

Filesize
468KB

Download
memory/2024-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-287-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2028-155-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2028-156-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2028-289-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2028-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-72-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2028-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-367-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2176-216-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2220-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-376-0x0000000000800000-0x0000000000875000-memory.dmp

Filesize
468KB

Download
memory/2220-377-0x0000000000800000-0x0000000000875000-memory.dmp

Filesize
468KB

Download
memory/2248-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-35-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2340-166-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2340-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-266-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2340-262-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2340-159-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2340-11-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2340-5-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2428-412-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2428-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-256-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2532-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-255-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2556-290-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2556-285-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2556-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-219-0x0000000000710000-0x0000000000785000-memory.dmp

Filesize
468KB

Download
memory/2700-344-0x0000000000710000-0x0000000000785000-memory.dmp

Filesize
468KB

Download
memory/2700-92-0x0000000000710000-0x0000000000785000-memory.dmp

Filesize
468KB

Download
memory/2700-346-0x0000000000710000-0x0000000000785000-memory.dmp

Filesize
468KB

Download
memory/2708-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-217-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2732-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-218-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2732-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-44-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2732-362-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2732-365-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2788-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-250-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2860-403-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2860-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-402-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2860-130-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2860-252-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2864-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-363-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2868-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-251-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2960-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-253-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2980-258-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2980-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-25-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2980-257-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2980-145-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2980-62-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2980-146-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3000-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download