0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8f

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
Size

468KB
MD5

9c21d7b8c254676cad5eaa9fe6741b00
SHA1

97312e424396f857fe10ce966e525990ccc161fe
SHA256

0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8f
SHA512

1015052255da4dffd09698ea963e9bb9d3ba974c341a0e7efde7c8fb2da632738099082f51f6c5d6ba63ed93c40dbbfbb96dddfac107ed9c343dc5add2dd8f53
SSDEEP

3072:WomTogYnI05ptbYzPz4jef8/U8MvkgpX+mHe6Vs/8sb8sMibqQlB:WoKom8ptYPEjefUcYn8sINibq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2500	Unicorn-25247.exe
2952	Unicorn-4157.exe
2948	Unicorn-33300.exe
2852	Unicorn-39461.exe
2788	Unicorn-38776.exe
3044	Unicorn-18910.exe
2628	Unicorn-16117.exe
2684	Unicorn-9518.exe
1588	Unicorn-38469.exe
2908	Unicorn-41999.exe
2900	Unicorn-5221.exe
2988	Unicorn-25087.exe
2872	Unicorn-8677.exe
584	Unicorn-52013.exe
608	Unicorn-50686.exe
1668	Unicorn-63493.exe
1744	Unicorn-50302.exe
1776	Unicorn-6809.exe
448	Unicorn-43788.exe
1396	Unicorn-39838.exe
2572	Unicorn-48783.exe
560	Unicorn-54913.exe
1000	Unicorn-50808.exe
1752	Unicorn-5136.exe
916	Unicorn-37809.exe
2480	Unicorn-45599.exe
2236	Unicorn-37159.exe
1636	Unicorn-56760.exe
1764	Unicorn-33842.exe
1608	Unicorn-39589.exe
1600	Unicorn-39589.exe
2508	Unicorn-19339.exe
328	Unicorn-21150.exe
2452	Unicorn-1550.exe
2376	Unicorn-50751.exe
2632	Unicorn-7959.exe
2176	Unicorn-53247.exe
2680	Unicorn-61099.exe
2636	Unicorn-57378.exe
2676	Unicorn-11706.exe
2232	Unicorn-12291.exe
840	Unicorn-18422.exe
2868	Unicorn-18156.exe
3060	Unicorn-44844.exe
2892	Unicorn-14010.exe
1056	Unicorn-50061.exe
2804	Unicorn-4389.exe
1036	Unicorn-30155.exe
1444	Unicorn-58914.exe
2256	Unicorn-47268.exe
2328	Unicorn-27363.exe
884	Unicorn-44348.exe
2296	Unicorn-43964.exe
2812	Unicorn-43699.exe
780	Unicorn-24098.exe
1032	Unicorn-56579.exe
1556	Unicorn-10907.exe
1860	Unicorn-57622.exe
900	Unicorn-11950.exe
2368	Unicorn-5436.exe
2520	Unicorn-11566.exe
2564	Unicorn-11758.exe
2484	Unicorn-51146.exe
1604	Unicorn-28679.exe

Loads dropped DLL 64 IoCs

pid	Process
1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
2500	Unicorn-25247.exe
2500	Unicorn-25247.exe
1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
2952	Unicorn-4157.exe
2952	Unicorn-4157.exe
2948	Unicorn-33300.exe
2948	Unicorn-33300.exe
2500	Unicorn-25247.exe
2500	Unicorn-25247.exe
1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
2788	Unicorn-38776.exe
2788	Unicorn-38776.exe
2948	Unicorn-33300.exe
2948	Unicorn-33300.exe
2628	Unicorn-16117.exe
2628	Unicorn-16117.exe
2952	Unicorn-4157.exe
3044	Unicorn-18910.exe
3044	Unicorn-18910.exe
2952	Unicorn-4157.exe
1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
2500	Unicorn-25247.exe
2500	Unicorn-25247.exe
2684	Unicorn-9518.exe
2684	Unicorn-9518.exe
2788	Unicorn-38776.exe
2788	Unicorn-38776.exe
1588	Unicorn-38469.exe
1588	Unicorn-38469.exe
2852	Unicorn-39461.exe
2852	Unicorn-39461.exe
2948	Unicorn-33300.exe
2948	Unicorn-33300.exe
1984	WerFault.exe
1984	WerFault.exe
1984	WerFault.exe
1984	WerFault.exe
1984	WerFault.exe
1984	WerFault.exe
2900	Unicorn-5221.exe
2900	Unicorn-5221.exe
2952	Unicorn-4157.exe
2908	Unicorn-41999.exe
2952	Unicorn-4157.exe
2908	Unicorn-41999.exe
2628	Unicorn-16117.exe
2628	Unicorn-16117.exe
2872	Unicorn-8677.exe
2872	Unicorn-8677.exe
2988	Unicorn-25087.exe
2988	Unicorn-25087.exe
1984	WerFault.exe
1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
2500	Unicorn-25247.exe
2500	Unicorn-25247.exe
3044	Unicorn-18910.exe
3044	Unicorn-18910.exe
1060	WerFault.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1984	1776	WerFault.exe	48
1060	1668	WerFault.exe	46
4052	700	WerFault.exe	186

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40337.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
2500	Unicorn-25247.exe
2952	Unicorn-4157.exe
2948	Unicorn-33300.exe
2788	Unicorn-38776.exe
2852	Unicorn-39461.exe
3044	Unicorn-18910.exe
2628	Unicorn-16117.exe
2684	Unicorn-9518.exe
1588	Unicorn-38469.exe
2900	Unicorn-5221.exe
2872	Unicorn-8677.exe
584	Unicorn-52013.exe
2908	Unicorn-41999.exe
2988	Unicorn-25087.exe
1668	Unicorn-63493.exe
608	Unicorn-50686.exe
448	Unicorn-43788.exe
1744	Unicorn-50302.exe
1776	Unicorn-6809.exe
2572	Unicorn-48783.exe
1396	Unicorn-39838.exe
1752	Unicorn-5136.exe
560	Unicorn-54913.exe
1000	Unicorn-50808.exe
916	Unicorn-37809.exe
2480	Unicorn-45599.exe
1636	Unicorn-56760.exe
2236	Unicorn-37159.exe
1764	Unicorn-33842.exe
1608	Unicorn-39589.exe
1600	Unicorn-39589.exe
2508	Unicorn-19339.exe
2376	Unicorn-50751.exe
328	Unicorn-21150.exe
2452	Unicorn-1550.exe
2632	Unicorn-7959.exe
2176	Unicorn-53247.exe
2680	Unicorn-61099.exe
2636	Unicorn-57378.exe
2676	Unicorn-11706.exe
840	Unicorn-18422.exe
2868	Unicorn-18156.exe
2232	Unicorn-12291.exe
3060	Unicorn-44844.exe
2892	Unicorn-14010.exe
1056	Unicorn-50061.exe
1036	Unicorn-30155.exe
2804	Unicorn-4389.exe
1444	Unicorn-58914.exe
2256	Unicorn-47268.exe
2328	Unicorn-27363.exe
884	Unicorn-44348.exe
2296	Unicorn-43964.exe
1556	Unicorn-10907.exe
780	Unicorn-24098.exe
2812	Unicorn-43699.exe
1032	Unicorn-56579.exe
1860	Unicorn-57622.exe
900	Unicorn-11950.exe
2520	Unicorn-11566.exe
2368	Unicorn-5436.exe
2484	Unicorn-51146.exe
2564	Unicorn-11758.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2500	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	30
PID 1300 wrote to memory of 2500	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	30
PID 1300 wrote to memory of 2500	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	30
PID 1300 wrote to memory of 2500	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	30
PID 1300 wrote to memory of 2948	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	31
PID 2500 wrote to memory of 2952	2500	Unicorn-25247.exe	32
PID 1300 wrote to memory of 2948	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	31
PID 1300 wrote to memory of 2948	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	31
PID 2500 wrote to memory of 2952	2500	Unicorn-25247.exe	32
PID 1300 wrote to memory of 2948	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	31
PID 2500 wrote to memory of 2952	2500	Unicorn-25247.exe	32
PID 2500 wrote to memory of 2952	2500	Unicorn-25247.exe	32
PID 2952 wrote to memory of 2852	2952	Unicorn-4157.exe	34
PID 2952 wrote to memory of 2852	2952	Unicorn-4157.exe	34
PID 2952 wrote to memory of 2852	2952	Unicorn-4157.exe	34
PID 2952 wrote to memory of 2852	2952	Unicorn-4157.exe	34
PID 2948 wrote to memory of 2788	2948	Unicorn-33300.exe	35
PID 2948 wrote to memory of 2788	2948	Unicorn-33300.exe	35
PID 2948 wrote to memory of 2788	2948	Unicorn-33300.exe	35
PID 2948 wrote to memory of 2788	2948	Unicorn-33300.exe	35
PID 2500 wrote to memory of 3044	2500	Unicorn-25247.exe	36
PID 2500 wrote to memory of 3044	2500	Unicorn-25247.exe	36
PID 2500 wrote to memory of 3044	2500	Unicorn-25247.exe	36
PID 2500 wrote to memory of 3044	2500	Unicorn-25247.exe	36
PID 1300 wrote to memory of 2628	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	37
PID 1300 wrote to memory of 2628	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	37
PID 1300 wrote to memory of 2628	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	37
PID 1300 wrote to memory of 2628	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	37
PID 2788 wrote to memory of 2684	2788	Unicorn-38776.exe	38
PID 2788 wrote to memory of 2684	2788	Unicorn-38776.exe	38
PID 2788 wrote to memory of 2684	2788	Unicorn-38776.exe	38
PID 2788 wrote to memory of 2684	2788	Unicorn-38776.exe	38
PID 2948 wrote to memory of 1588	2948	Unicorn-33300.exe	39
PID 2948 wrote to memory of 1588	2948	Unicorn-33300.exe	39
PID 2948 wrote to memory of 1588	2948	Unicorn-33300.exe	39
PID 2948 wrote to memory of 1588	2948	Unicorn-33300.exe	39
PID 2628 wrote to memory of 2908	2628	Unicorn-16117.exe	40
PID 2628 wrote to memory of 2908	2628	Unicorn-16117.exe	40
PID 2628 wrote to memory of 2908	2628	Unicorn-16117.exe	40
PID 2628 wrote to memory of 2908	2628	Unicorn-16117.exe	40
PID 3044 wrote to memory of 2988	3044	Unicorn-18910.exe	42
PID 3044 wrote to memory of 2988	3044	Unicorn-18910.exe	42
PID 3044 wrote to memory of 2988	3044	Unicorn-18910.exe	42
PID 3044 wrote to memory of 2988	3044	Unicorn-18910.exe	42
PID 2952 wrote to memory of 2900	2952	Unicorn-4157.exe	41
PID 2952 wrote to memory of 2900	2952	Unicorn-4157.exe	41
PID 2952 wrote to memory of 2900	2952	Unicorn-4157.exe	41
PID 2952 wrote to memory of 2900	2952	Unicorn-4157.exe	41
PID 1300 wrote to memory of 2872	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	43
PID 1300 wrote to memory of 2872	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	43
PID 1300 wrote to memory of 2872	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	43
PID 1300 wrote to memory of 2872	1300	0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe	43
PID 2500 wrote to memory of 584	2500	Unicorn-25247.exe	44
PID 2500 wrote to memory of 584	2500	Unicorn-25247.exe	44
PID 2500 wrote to memory of 584	2500	Unicorn-25247.exe	44
PID 2500 wrote to memory of 584	2500	Unicorn-25247.exe	44
PID 2684 wrote to memory of 608	2684	Unicorn-9518.exe	45
PID 2684 wrote to memory of 608	2684	Unicorn-9518.exe	45
PID 2684 wrote to memory of 608	2684	Unicorn-9518.exe	45
PID 2684 wrote to memory of 608	2684	Unicorn-9518.exe	45
PID 2788 wrote to memory of 1668	2788	Unicorn-38776.exe	46
PID 2788 wrote to memory of 1668	2788	Unicorn-38776.exe	46
PID 2788 wrote to memory of 1668	2788	Unicorn-38776.exe	46
PID 2788 wrote to memory of 1668	2788	Unicorn-38776.exe	46

C:\Users\Admin\AppData\Local\Temp\0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe
"C:\Users\Admin\AppData\Local\Temp\0b9cf6abfd3a4ec31cbada346cdea90c869e07823ebbb7c43da969b0ff535f8fN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25247.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25247.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4157.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 200
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        5⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        6⤵
        
        PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        5⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18318.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5221.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7959.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        8⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        9⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        9⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        9⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
        8⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52345.exe
        7⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
        8⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        8⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        8⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58505.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        7⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16672.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3666.exe
        7⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28256.exe
        7⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
        6⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
        6⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        6⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        6⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        7⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23445.exe
        7⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15731.exe
        6⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6188.exe
        6⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13687.exe
        5⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        6⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40102.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11706.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        6⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
        7⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65023.exe
        6⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17781.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20471.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        6⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56638.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2229.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
        5⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59982.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21917.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        5⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        5⤵
        
        PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
      4⤵
      PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26407.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        5⤵
        
        PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2778.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
      4⤵
      PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25087.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37809.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        6⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
        7⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        8⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
        7⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        6⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        6⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54198.exe
        6⤵
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10274.exe
        6⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        7⤵
        
        PID:700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 200
        8⤵
        Program crash
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        7⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        6⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20469.exe
        6⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        6⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        5⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
        6⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32667.exe
        5⤵
        
        PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exe
        6⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exe
        7⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        6⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17014.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        5⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34847.exe
        5⤵
        
        PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        5⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65303.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
      4⤵
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
        5⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        5⤵
        
        PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
      4⤵
      PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
      4⤵
      PID:6636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50751.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11566.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        6⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24949.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        7⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2676.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52537.exe
        5⤵
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48456.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        6⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        5⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        5⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
        5⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
        5⤵
        
        PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
      4⤵
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        5⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        5⤵
        
        PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38020.exe
      4⤵
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40102.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14961.exe
      4⤵
      PID:6516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
        5⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        6⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        6⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42452.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2479.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        5⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        5⤵
        
        PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
      4⤵
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        5⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        5⤵
        
        PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8344.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
      4⤵
      PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
      4⤵
      PID:7280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27363.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
      4⤵
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        5⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6349.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
      4⤵
      PID:7488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
    3⤵
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9878.exe
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
      4⤵
      PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
      4⤵
      PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
    3⤵
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
    3⤵
    PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54599.exe
    3⤵
    PID:6352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
    3⤵
    PID:6688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        7⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        7⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        6⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47300.exe
        7⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        7⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        7⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
        6⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
        7⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57974.exe
        8⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        8⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        8⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30815.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        7⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        7⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19864.exe
        6⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        7⤵
        
        PID:276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        7⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35615.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59027.exe
        6⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        7⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        7⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        7⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        5⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        6⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exe
        6⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62517.exe
        5⤵
        
        PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 240
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40145.exe
        6⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39828.exe
        7⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        5⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        6⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9252.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7145.exe
        5⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
        5⤵
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        5⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        5⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        5⤵
        
        PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26666.exe
      4⤵
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57181.exe
      4⤵
      PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exe
        8⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26454.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        7⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
        7⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        6⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6592.exe
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        6⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45296.exe
        6⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        6⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45471.exe
        5⤵
        
        PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
        5⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        5⤵
        
        PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11758.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        6⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        6⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        5⤵
        
        PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        5⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
        5⤵
        
        PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
      4⤵
      Executes dropped EXE
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        5⤵
        
        PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        5⤵
        
        PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40241.exe
      4⤵
      PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exe
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe
      4⤵
      PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      4⤵
      PID:7932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        6⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51501.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        6⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
        6⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        5⤵
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1253.exe
        5⤵
        
        PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2479.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        5⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
      4⤵
      PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
      4⤵
      PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
      4⤵
      PID:7672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21150.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
        5⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
        5⤵
        
        PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39161.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
      4⤵
      PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe
      4⤵
      PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      4⤵
      PID:7940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
    3⤵
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
      4⤵
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
      4⤵
      PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
      4⤵
      PID:7900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14264.exe
    3⤵
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
      4⤵
      PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8166.exe
      4⤵
      PID:7408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
    3⤵
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44215.exe
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50399.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12949.exe
    3⤵
    PID:7088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54913.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        6⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32326.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7145.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        6⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        6⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29326.exe
        5⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46564.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35597.exe
        6⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61934.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        7⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15731.exe
        5⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        5⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15830.exe
        5⤵
        
        PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
      4⤵
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        5⤵
        
        PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        5⤵
        
        PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
      4⤵
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46564.exe
      4⤵
      PID:6996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50808.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        5⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        6⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        6⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2676.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23420.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        5⤵
        
        PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-761.exe
      4⤵
      PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
      4⤵
      PID:8168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        5⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        5⤵
        
        PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
      4⤵
      PID:6792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39880.exe
    3⤵
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48877.exe
    3⤵
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
    3⤵
    PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46564.exe
    3⤵
    PID:7004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8677.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8677.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10658.exe
        5⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        6⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        7⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        7⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
        6⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36475.exe
        5⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        6⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        5⤵
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
      4⤵
      PID:372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        5⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        5⤵
        
        PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
      4⤵
      PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
      4⤵
      PID:8044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
      4⤵
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6341.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10016.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        6⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42452.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
        5⤵
        
        PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
      4⤵
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38904.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        5⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        5⤵
        
        PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
      4⤵
      PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
      4⤵
      PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20622.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4912.exe
    3⤵
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
      4⤵
      PID:6940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
    3⤵
    PID:3776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56638.exe
    3⤵
    PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
    3⤵
    PID:5156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
    3⤵
    PID:6776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45599.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45599.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
      4⤵
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        5⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        5⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        5⤵
        
        PID:8180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18549.exe
      4⤵
      PID:1304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-419.exe
    3⤵
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
      4⤵
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
      4⤵
      PID:6988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
    3⤵
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
      4⤵
      PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
      4⤵
      PID:6752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
    3⤵
    PID:3344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
    3⤵
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
    3⤵
    PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
    3⤵
    PID:6768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44844.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44844.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
    3⤵
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7065.exe
      4⤵
      PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
      4⤵
      PID:6784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
    3⤵
    PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
    3⤵
    PID:6440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
    3⤵
    PID:7236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18319.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18319.exe
  2⤵
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29484.exe
    3⤵
    PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
    3⤵
    PID:4484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
    3⤵
    PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
    3⤵
    PID:6392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
    3⤵
    PID:7824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64514.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64514.exe
  2⤵
  PID:2496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
  2⤵
  PID:4248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34414.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34414.exe
  2⤵
  PID:4908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
  2⤵
  PID:5876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48118.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48118.exe
  2⤵
  PID:7500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe

Filesize
468KB

MD5
06b30bd682772aaacec1a546c436db87

SHA1
c1956b9dd35cbe4d7dc3b639da6886664dd250aa

SHA256
296c127f5f6dd8e9ecd148fbf9be252859722b0f1b868f59326cce4c73c6b779

SHA512
34ca6a4193b365b596d19ec6da95a7e22911f09fadc51ed05e5801fb9a08daaa31b782db32b26a62cfc2a288164b75d6d95dec98e010980f451ac92dcdccb42a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4157.exe

Filesize
468KB

MD5
3e78192da829c8fb71816cee6ca5a82d

SHA1
0141b8a4da4691a52ca730c444e27d76d9d53661

SHA256
3aec4ca34fd721b31c7e276e23b2eff3f6fc5c87bac56b8974f49f5b67e43288

SHA512
1143aa095d9cbca92ee0ac6bd92406c82d3052a8b4fedc239a58f274920dc55b98379991e57f34a59575085a21d75e5c37358ef38c30cfb8badb47ff44632b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe

Filesize
468KB

MD5
5d7168291c49275baceb53c075cc4c95

SHA1
214c660c443a00360be4654f765c3594b841fd35

SHA256
ba50c51b03e555529094bb3337c7c27d70a40654cb704be20c7438e1bfeff36a

SHA512
20c3159ac31d0f8698b17c60185556cfff63d1a7998a830be4e2099fa88ec6861ec6b0865395f33d02ac0ca04fd8b090c029f2390d4ebdfc22e8380ffa3b6d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8677.exe

Filesize
468KB

MD5
2092e7bd9c3f190c6fa313b8a495363e

SHA1
4b40c3a4b88afe0eb2c6b3c46df8ea1585ae2810

SHA256
caa0f2229cbc8abd72d31626b4ad7d58f2efd8f25828789d712179981a3a56c8

SHA512
3b6cbeb8f7453d1cd5a48f76ecdada7ea484fe15278ea08484dd1c9609064b42b172ba37ea0f85308d3015022daf183785ac2f590cdab91a72a8e92d21f8397a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe

Filesize
468KB

MD5
3ff521b69e82e195d65a2d25505f27fa

SHA1
967d5a9491a891b6b8b2ba1c7198cdf77ee0618f

SHA256
b29b24a003efc523e0268c6cfbb340c5d48879c1c1e4ab0daedb3e5b87d4277c

SHA512
c2dc7a48067cec4d0f476b3e21474b6c4ba65538ef05410ee98f720a46e99173a722d40693b3e4fddb972c40713bf3be56eb6638ab0013f5f9aa4f6a04241653

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe

Filesize
468KB

MD5
e2031356aa59c94525a6c3e93a83bcb6

SHA1
d76696bfacbebf4b15b777f30b032bac048aaefe

SHA256
764a3762b3ee08f9c6c95ed298d20a0ed551bc482e7ae5d01990e835de368f72

SHA512
2739186335c495358174fc6888141607c2fef68a441fd40274b8759a9b61742bf4b0dd74992fa46557e11ba8e306682969c9749c93aae535d1c440f48b6f48b2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25087.exe

Filesize
468KB

MD5
990c6d6335ab9e53df1cb443381fb340

SHA1
c02ca6cb8017de22f26e730d138ec6d5411d9e12

SHA256
7803a4c006f448f9e32bb3682cb669f0ebe3dbd06fb7bea5c02e464c3940022a

SHA512
1823793429e60d784dad74ad442c7dda65b8c744482ba361704a73367a2204ae734bab8fda10d926b3e6aaf4631b139d89d70aeb79b765f9632a68f701b521fe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25247.exe

Filesize
468KB

MD5
ca24a101593ffd266b167e09d4dbb9c1

SHA1
1fccfe600063636425c7e1175a27f8329c1a5910

SHA256
20b4045bd929336641dd3cce647465a759b399caa934d28ce2d016a18be74216

SHA512
5607c3cc2b4c450400d554b9775261c5872cbf6d25466b3495a38f717532b1aae1407dc26b8e0b08b92638bc9322d64bf96f1c53f91242bcd735afed9b60735f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe

Filesize
468KB

MD5
9097576e26ccb67f3daedf9a01f003fe

SHA1
9b459a7e3f6a4fb399388fdff28eb2eddd6df2fc

SHA256
b60043b113a88820df061f816f1e6e9632cd3cd00f8b37e9354edf131c8cdb10

SHA512
483337b89c3f30835e1123a958ff369cb39af7fb1c17de545eab91f98ee2d172a399f230b248f7bef81df6b4a4c5ac0876780b703930e4c8ac146afbeb8f14ba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe

Filesize
468KB

MD5
f23c3467517f1b2f2bef1b5cc70a26e5

SHA1
e9d64186bc7203e86a26e494645486ba52613a65

SHA256
4ede0a7dedb107f4c3722885a9cd61ec870cce3e8364d8d7d965ae8273530319

SHA512
afd3ba8835e3c8790135e380ba6f2753eeba26a4af7ea88bc8511b0347b370164ccca7310dd9447a6bfa72c02cd5db116c47e6fe4938b1e6c237ecad0c6255bc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe

Filesize
468KB

MD5
607ed275598f0cd16a4374772687a500

SHA1
2a73d314a6e6617bf5bac13f1d20b45368696d0e

SHA256
728b67abd69cc5061f57ec823771d1207a352ce81280d9d92a30c7f3c69f295f

SHA512
1a3af8eb615253eb50f6da4f6794ffe1d1cb4c8af4f5374026f139ab6e9be74d5ce67884023844dc1b4371dd9ea2a10c7d449715c2320aea412a9b1c95f03870

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe

Filesize
468KB

MD5
dc15709b695547fb48843e8b60f6574b

SHA1
881e1237cb4f550a9670327781207b87713f0ef0

SHA256
e98cd170a9bf4a6413b3f2134c1e367c2c8d5d400aeba1fb831c1cfe64f0b3ba

SHA512
5d565aa21ea118c46cdb90e749e00b8439c62f52d8b7e7066f30352f7eff5b8660f6ebc855432c4101437db06b5ae479e1be6b808bb3db526a76feff27145278

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe

Filesize
468KB

MD5
5a6d2cc8bb5c133211c25edc548509dc

SHA1
a7b1e1fc7ad3811d763ac7f7eb18572c3930e7ee

SHA256
6043a2eb2bad0ef6b366718ac5f47a1e80b1399f8fce3d18e87eba6ebc7f6b4f

SHA512
ff39c613dc02b7319d3b3b17945db371e247d2896fb41338de44db732190722a6dd2c6374af0a5272e12537af3c74c469b06d6bbd72d585fa3d513985d924d94

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe

Filesize
468KB

MD5
9f046046af3f6fbefc260ae44bd396d0

SHA1
d80045d3a0873c82ef1d26c4b8d4637035145f25

SHA256
6c025c0d6faebae42d5ebfa58aeee87dac063e132752ba11d290c24b644576f0

SHA512
2c51a3ff74102960af8b6f107445b7a2856593e862b837dd41adf13a1d99481e7be6f35e4b46733c059d0ef51e7bccfeb36a428b2bdcec709b0a978b91ea6b47

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe

Filesize
468KB

MD5
1f0d52e9960179b8d6b89a539018df1e

SHA1
1cf206303a4a63917c45d57a806bc9cd5930c1d4

SHA256
93bab80b8068c6448572640b06d77d65f232b1de93467797d24f3b1f150ff8be

SHA512
57e87fc6a69b0f6731c42f07525ea8381014421d39a9805756334ba6c2c5a22d173c2b0e4baab69a8f7b08ad9d9d3476ec65a9122ff36399722dd96615a65183

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5221.exe

Filesize
468KB

MD5
abbd401c467cae713e84b4e631385ccb

SHA1
36491416c7e23d372e6546d3222fdaa94ed27104

SHA256
a6ae4e5b30b2204166592bdf96c0c846f94dac704dce9ad7b0f126b5c302b24b

SHA512
c48ab5e109944f352d22be74ad97a76e007dfed4bf0a43ffb7a32f1b2acd36fe8be58cba19904d313cceca11ee89c3d94fc1548f4f996fe97a2df6afc0998ff1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe

Filesize
468KB

MD5
fefbe6f8b73256867dcfac789a4a017d

SHA1
dc15420f3a1bffd6eadf64501cb2cc2bfb03d2d4

SHA256
d752b79f200e4d8957350ac35ee27174687b4128bcf7ea4cd48c30ac9a14cbe3

SHA512
cbff895711a3c53990be3b265439e71f9a95ea3094e575ddac441534f5c1fefa0e5236dd1dc420e8101a8719b129da4e4bcb303c676f7e6614b83189ff52538c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe

Filesize
468KB

MD5
3cada95a0c179138067d3c9b955dae83

SHA1
2f7e70332262a50d4782e15d527bf3a8fc44b660

SHA256
c6a87a0cee0a9151d01f13b94b402b3c8ea04299592fed133c2dfd62d512086d

SHA512
cba15777400c28838569293b96b2eb2c4dc3891201d883a644f2c37da85bcacd6295cf1005f2866ae0f91f43d66e675591b01fc408e4d299095a344876535f8b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe

Filesize
468KB

MD5
21ac9a272253f17b3be2c73d9bf397be

SHA1
ea896408a9532138047c7196f2d7be161e907498

SHA256
78d2b28b217b8dcd2dfd3f1cc395faca8ad6574ab94aef6c63de97abd0041cab

SHA512
19b43aaf9b425ecc2f97d0dcf7cec4ebdd03d0a06766815df3a8493fc838d3618bf3675d3001658a6d6b32370c0020b3f62e3893c39bacdb332c59544ca9b1a7

Download Submit