5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda

Analysis

max time kernel
147s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
Size

468KB
MD5

fb98366334d35ca3bb7cf409c6599685
SHA1

d8dc2db2a3afb013c45e2d8ce53011f6462ec9bf
SHA256

5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda
SHA512

8542ed1abf41a8371f7fe0c5ae61629d50e3d9b08343ae10704bafe8d86c57d43db77e97b6b949012f77c646f7182f4741d199d5ae54be4fdff33104c137069f
SSDEEP

3072:idoeow1Njf8U6bY9foOjif5EChSOcplnmHKPbzinYkDpGgX7NMjqW:idhoGkU6efbjifBQXiYkDsm7NM

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2580	Unicorn-6490.exe
2140	Unicorn-46236.exe
2228	Unicorn-18010.exe
2920	Unicorn-10403.exe
3056	Unicorn-25348.exe
2712	Unicorn-18380.exe
2896	Unicorn-38892.exe
2800	Unicorn-32853.exe
2284	Unicorn-60626.exe
3024	Unicorn-4648.exe
2576	Unicorn-28888.exe
2364	Unicorn-9287.exe
2020	Unicorn-29153.exe
2944	Unicorn-49665.exe
2276	Unicorn-27482.exe
2484	Unicorn-19868.exe
2588	Unicorn-41680.exe
1616	Unicorn-36126.exe
1788	Unicorn-22390.exe
1028	Unicorn-44586.exe
1932	Unicorn-19624.exe
1820	Unicorn-7637.exe
2260	Unicorn-46532.exe
2544	Unicorn-14335.exe
1016	Unicorn-600.exe
2308	Unicorn-20466.exe
2612	Unicorn-27242.exe
2388	Unicorn-30694.exe
3044	Unicorn-39625.exe
2760	Unicorn-29986.exe
2892	Unicorn-50891.exe
2948	Unicorn-18027.exe
2908	Unicorn-63698.exe
2688	Unicorn-37055.exe
2792	Unicorn-11704.exe
2116	Unicorn-52380.exe
2660	Unicorn-56921.exe
1664	Unicorn-17835.exe
2724	Unicorn-59422.exe
2984	Unicorn-27155.exe
2052	Unicorn-28146.exe
2236	Unicorn-30806.exe
560	Unicorn-48273.exe
1064	Unicorn-1039.exe
1784	Unicorn-15237.exe
1728	Unicorn-61339.exe
1424	Unicorn-23960.exe
2436	Unicorn-53940.exe
2564	Unicorn-34074.exe
2508	Unicorn-62200.exe
1596	Unicorn-1423.exe
2600	Unicorn-42264.exe
1920	Unicorn-22398.exe
2880	Unicorn-11537.exe
2788	Unicorn-30374.exe
2764	Unicorn-2912.exe
2720	Unicorn-57038.exe
2680	Unicorn-56773.exe
2340	Unicorn-8392.exe
1972	Unicorn-24281.exe
2368	Unicorn-60608.exe
2868	Unicorn-49747.exe
3012	Unicorn-10660.exe
2772	Unicorn-41479.exe

Loads dropped DLL 64 IoCs

pid	Process
2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
2580	Unicorn-6490.exe
2580	Unicorn-6490.exe
2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
2140	Unicorn-46236.exe
2140	Unicorn-46236.exe
2580	Unicorn-6490.exe
2580	Unicorn-6490.exe
2228	Unicorn-18010.exe
2228	Unicorn-18010.exe
2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
2920	Unicorn-10403.exe
2920	Unicorn-10403.exe
2140	Unicorn-46236.exe
2140	Unicorn-46236.exe
2712	Unicorn-18380.exe
2712	Unicorn-18380.exe
2580	Unicorn-6490.exe
2228	Unicorn-18010.exe
2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
3056	Unicorn-25348.exe
2580	Unicorn-6490.exe
2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
2228	Unicorn-18010.exe
3056	Unicorn-25348.exe
2800	Unicorn-32853.exe
2800	Unicorn-32853.exe
2920	Unicorn-10403.exe
2920	Unicorn-10403.exe
2284	Unicorn-60626.exe
2284	Unicorn-60626.exe
2896	Unicorn-38892.exe
2896	Unicorn-38892.exe
2140	Unicorn-46236.exe
2140	Unicorn-46236.exe
2944	Unicorn-49665.exe
2580	Unicorn-6490.exe
2580	Unicorn-6490.exe
2944	Unicorn-49665.exe
3024	Unicorn-4648.exe
2364	Unicorn-9287.exe
3024	Unicorn-4648.exe
2364	Unicorn-9287.exe
3056	Unicorn-25348.exe
3056	Unicorn-25348.exe
2228	Unicorn-18010.exe
2228	Unicorn-18010.exe
2712	Unicorn-18380.exe
2576	Unicorn-28888.exe
2712	Unicorn-18380.exe
2576	Unicorn-28888.exe
2484	Unicorn-19868.exe
2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
2484	Unicorn-19868.exe
2920	Unicorn-10403.exe
2920	Unicorn-10403.exe
2276	Unicorn-27482.exe
2276	Unicorn-27482.exe
2800	Unicorn-32853.exe
2588	Unicorn-41680.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1488	2052	WerFault.exe	71
1764	2688	WerFault.exe	64

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53360.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
2580	Unicorn-6490.exe
2140	Unicorn-46236.exe
2228	Unicorn-18010.exe
2920	Unicorn-10403.exe
3056	Unicorn-25348.exe
2712	Unicorn-18380.exe
2896	Unicorn-38892.exe
2800	Unicorn-32853.exe
2284	Unicorn-60626.exe
3024	Unicorn-4648.exe
2364	Unicorn-9287.exe
2576	Unicorn-28888.exe
2944	Unicorn-49665.exe
2020	Unicorn-29153.exe
2276	Unicorn-27482.exe
2484	Unicorn-19868.exe
2588	Unicorn-41680.exe
1616	Unicorn-36126.exe
1788	Unicorn-22390.exe
1932	Unicorn-19624.exe
1028	Unicorn-44586.exe
2260	Unicorn-46532.exe
1820	Unicorn-7637.exe
3044	Unicorn-39625.exe
2388	Unicorn-30694.exe
2760	Unicorn-29986.exe
2308	Unicorn-20466.exe
2612	Unicorn-27242.exe
2544	Unicorn-14335.exe
2892	Unicorn-50891.exe
1016	Unicorn-600.exe
2908	Unicorn-63698.exe
2660	Unicorn-56921.exe
2116	Unicorn-52380.exe
1664	Unicorn-17835.exe
2724	Unicorn-59422.exe
2688	Unicorn-37055.exe
2792	Unicorn-11704.exe
2948	Unicorn-18027.exe
2984	Unicorn-27155.exe
2052	Unicorn-28146.exe
2236	Unicorn-30806.exe
560	Unicorn-48273.exe
1064	Unicorn-1039.exe
1784	Unicorn-15237.exe
2564	Unicorn-34074.exe
1424	Unicorn-23960.exe
1728	Unicorn-61339.exe
2508	Unicorn-62200.exe
2436	Unicorn-53940.exe
2600	Unicorn-42264.exe
2788	Unicorn-30374.exe
2764	Unicorn-2912.exe
1596	Unicorn-1423.exe
2720	Unicorn-57038.exe
1920	Unicorn-22398.exe
2340	Unicorn-8392.exe
2880	Unicorn-11537.exe
2680	Unicorn-56773.exe
656	Unicorn-42709.exe
2772	Unicorn-41479.exe
3012	Unicorn-10660.exe
1972	Unicorn-24281.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2580	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	30
PID 2240 wrote to memory of 2580	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	30
PID 2240 wrote to memory of 2580	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	30
PID 2240 wrote to memory of 2580	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	30
PID 2580 wrote to memory of 2140	2580	Unicorn-6490.exe	32
PID 2580 wrote to memory of 2140	2580	Unicorn-6490.exe	32
PID 2580 wrote to memory of 2140	2580	Unicorn-6490.exe	32
PID 2580 wrote to memory of 2140	2580	Unicorn-6490.exe	32
PID 2240 wrote to memory of 2228	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	33
PID 2240 wrote to memory of 2228	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	33
PID 2240 wrote to memory of 2228	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	33
PID 2240 wrote to memory of 2228	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	33
PID 2140 wrote to memory of 2920	2140	Unicorn-46236.exe	34
PID 2140 wrote to memory of 2920	2140	Unicorn-46236.exe	34
PID 2140 wrote to memory of 2920	2140	Unicorn-46236.exe	34
PID 2140 wrote to memory of 2920	2140	Unicorn-46236.exe	34
PID 2580 wrote to memory of 3056	2580	Unicorn-6490.exe	35
PID 2580 wrote to memory of 3056	2580	Unicorn-6490.exe	35
PID 2580 wrote to memory of 3056	2580	Unicorn-6490.exe	35
PID 2580 wrote to memory of 3056	2580	Unicorn-6490.exe	35
PID 2228 wrote to memory of 2712	2228	Unicorn-18010.exe	36
PID 2228 wrote to memory of 2712	2228	Unicorn-18010.exe	36
PID 2228 wrote to memory of 2712	2228	Unicorn-18010.exe	36
PID 2228 wrote to memory of 2712	2228	Unicorn-18010.exe	36
PID 2240 wrote to memory of 2896	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	37
PID 2240 wrote to memory of 2896	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	37
PID 2240 wrote to memory of 2896	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	37
PID 2240 wrote to memory of 2896	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	37
PID 2920 wrote to memory of 2800	2920	Unicorn-10403.exe	38
PID 2920 wrote to memory of 2800	2920	Unicorn-10403.exe	38
PID 2920 wrote to memory of 2800	2920	Unicorn-10403.exe	38
PID 2920 wrote to memory of 2800	2920	Unicorn-10403.exe	38
PID 2140 wrote to memory of 2284	2140	Unicorn-46236.exe	39
PID 2140 wrote to memory of 2284	2140	Unicorn-46236.exe	39
PID 2140 wrote to memory of 2284	2140	Unicorn-46236.exe	39
PID 2140 wrote to memory of 2284	2140	Unicorn-46236.exe	39
PID 2712 wrote to memory of 3024	2712	Unicorn-18380.exe	40
PID 2712 wrote to memory of 3024	2712	Unicorn-18380.exe	40
PID 2712 wrote to memory of 3024	2712	Unicorn-18380.exe	40
PID 2712 wrote to memory of 3024	2712	Unicorn-18380.exe	40
PID 2580 wrote to memory of 2944	2580	Unicorn-6490.exe	41
PID 2580 wrote to memory of 2944	2580	Unicorn-6490.exe	41
PID 2580 wrote to memory of 2944	2580	Unicorn-6490.exe	41
PID 2580 wrote to memory of 2944	2580	Unicorn-6490.exe	41
PID 2240 wrote to memory of 2576	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	43
PID 2240 wrote to memory of 2576	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	43
PID 2240 wrote to memory of 2576	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	43
PID 2240 wrote to memory of 2576	2240	5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe	43
PID 2228 wrote to memory of 2364	2228	Unicorn-18010.exe	42
PID 2228 wrote to memory of 2364	2228	Unicorn-18010.exe	42
PID 2228 wrote to memory of 2364	2228	Unicorn-18010.exe	42
PID 2228 wrote to memory of 2364	2228	Unicorn-18010.exe	42
PID 3056 wrote to memory of 2020	3056	Unicorn-25348.exe	44
PID 3056 wrote to memory of 2020	3056	Unicorn-25348.exe	44
PID 3056 wrote to memory of 2020	3056	Unicorn-25348.exe	44
PID 3056 wrote to memory of 2020	3056	Unicorn-25348.exe	44
PID 2800 wrote to memory of 2276	2800	Unicorn-32853.exe	45
PID 2800 wrote to memory of 2276	2800	Unicorn-32853.exe	45
PID 2800 wrote to memory of 2276	2800	Unicorn-32853.exe	45
PID 2800 wrote to memory of 2276	2800	Unicorn-32853.exe	45
PID 2920 wrote to memory of 2484	2920	Unicorn-10403.exe	46
PID 2920 wrote to memory of 2484	2920	Unicorn-10403.exe	46
PID 2920 wrote to memory of 2484	2920	Unicorn-10403.exe	46
PID 2920 wrote to memory of 2484	2920	Unicorn-10403.exe	46

C:\Users\Admin\AppData\Local\Temp\5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe
"C:\Users\Admin\AppData\Local\Temp\5a23cb77a48a7f19a1e4c722a682ab9c7fe5bc1fc470e753f9a197f7df70ccda.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50891.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22097.exe
        8⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        9⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
        9⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        9⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        9⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
        9⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exe
        8⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        8⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
        8⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33605.exe
        8⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7928.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
        8⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        9⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        9⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        9⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        9⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5405.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        8⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        8⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        8⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6005.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53190.exe
        8⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        8⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41516.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe
        8⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32768.exe
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe
        8⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
        7⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19790.exe
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25428.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        8⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36017.exe
        9⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        8⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        8⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        8⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
        8⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22391.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        7⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32747.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        7⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26437.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8719.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40637.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        7⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe
        6⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17947.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54920.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53890.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50849.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5330.exe
        6⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19868.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39625.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        7⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        8⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        8⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        7⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        6⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28144.exe
        7⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        7⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55021.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12619.exe
        7⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8199.exe
        6⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2265.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        6⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19310.exe
        6⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29986.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        6⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47111.exe
        7⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37738.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9520.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
        7⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12170.exe
        6⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60146.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20688.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17001.exe
        5⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41516.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43799.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32768.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        7⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
        7⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57043.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31687.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        6⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6465.exe
        6⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5954.exe
        5⤵
        
        PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exe
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20434.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16489.exe
        5⤵
        
        PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18027.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2061.exe
        7⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        8⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
        8⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        8⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        7⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        8⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        8⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        8⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
        8⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26351.exe
        8⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        7⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        7⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30374.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        7⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64060.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6914.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe
        8⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
        7⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        7⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        7⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        6⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34568.exe
        6⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37055.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 220
        6⤵
        Program crash
        
        PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        6⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        5⤵
        
        PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3102.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        5⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36126.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47661.exe
        7⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22060.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60842.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        7⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        6⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2265.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        6⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        6⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        7⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37738.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9520.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        6⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
        5⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44992.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10050.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21353.exe
        5⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1514.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52380.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30178.exe
        5⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        6⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49601.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        5⤵
        
        PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30265.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13714.exe
        5⤵
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe
      4⤵
      PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50592.exe
      4⤵
      PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22919.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63797.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
      4⤵
      PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46748.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        6⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        7⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47505.exe
        7⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
        7⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29419.exe
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18275.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26319.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51474.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        6⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47782.exe
        6⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
        5⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42652.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        6⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52385.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31771.exe
        5⤵
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41882.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5437.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19917.exe
        5⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27947.exe
        5⤵
        
        PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        5⤵
        
        PID:700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        5⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16880.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        5⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
      4⤵
      PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51267.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exe
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
      4⤵
      PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
      4⤵
      PID:6192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7151.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55435.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22585.exe
        5⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51474.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2265.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        5⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        5⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        5⤵
        
        PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48050.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41199.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15542.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39659.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe
        5⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5014.exe
        5⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20814.exe
      4⤵
      PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41523.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51023.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60574.exe
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
      4⤵
      PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27155.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe
        5⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        5⤵
        
        PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3391.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2912.exe
      4⤵
      PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3328.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe
        5⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        5⤵
        
        PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
      4⤵
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51978.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59308.exe
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28146.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 320
      4⤵
      Program crash
      PID:1488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe
      4⤵
      PID:744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
      4⤵
      PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52177.exe
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40104.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22219.exe
      4⤵
      PID:6632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56972.exe
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exe
    3⤵
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61591.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9377.exe
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37116.exe
    3⤵
    PID:5368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe
    3⤵
    PID:5984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
    3⤵
    PID:6920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18010.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18010.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11890.exe
        7⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22060.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53094.exe
        7⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18692.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35641.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57170.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-689.exe
        6⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
        5⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36824.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6843.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57725.exe
        5⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe
        5⤵
        
        PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1506.exe
        5⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        6⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37738.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55022.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6633.exe
        5⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55689.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
        6⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33687.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14583.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
        5⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
      4⤵
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33276.exe
        5⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        5⤵
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50846.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46579.exe
        5⤵
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
      4⤵
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42392.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
      4⤵
      PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
      4⤵
      PID:6400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9287.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15237.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
        6⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        7⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20688.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        7⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7894.exe
        6⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29419.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22359.exe
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39583.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46986.exe
        5⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49228.exe
        6⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
        7⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59861.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20581.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
        5⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
        5⤵
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64382.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1054.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        5⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
        5⤵
        
        PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        5⤵
        
        PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60441.exe
      4⤵
      PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51267.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
      4⤵
      PID:6420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34984.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27271.exe
        5⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        5⤵
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30945.exe
      4⤵
      PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2265.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22806.exe
      4⤵
      PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55758.exe
      4⤵
      PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11423.exe
      4⤵
      PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33520.exe
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32138.exe
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32359.exe
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13911.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
    3⤵
    PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
    3⤵
    PID:6336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        5⤵
        Executes dropped EXE
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23541.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        6⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50354.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
        5⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60608.exe
      4⤵
      Executes dropped EXE
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14594.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25633.exe
        5⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61209.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
      4⤵
      PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9051.exe
      4⤵
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35359.exe
      4⤵
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
      4⤵
      PID:6788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11704.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22306.exe
        5⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5065.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34252.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        5⤵
        
        PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47282.exe
      4⤵
      PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14583.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
      4⤵
      PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22801.exe
      4⤵
      PID:3276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2912.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
      4⤵
      PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63758.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61728.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
      4⤵
      PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47992.exe
      4⤵
      PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
      4⤵
      PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe
    3⤵
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58045.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
      4⤵
      PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46124.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59611.exe
    3⤵
    PID:3336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46557.exe
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
    3⤵
    PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
    3⤵
    PID:6676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20466.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        5⤵
        
        PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17956.exe
        5⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
        5⤵
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31491.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16503.exe
        5⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37539.exe
        5⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61093.exe
        5⤵
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
      4⤵
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
      4⤵
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65341.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7876.exe
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
      4⤵
      PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35871.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31062.exe
      4⤵
      PID:7196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52636.exe
    3⤵
    PID:108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30848.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2290.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
      4⤵
      PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
      4⤵
      PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
      4⤵
      PID:7264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52707.exe
    3⤵
    PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62282.exe
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
    3⤵
    PID:6572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30694.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30694.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41828.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        5⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62025.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6313.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        5⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1353.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
      4⤵
      PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14583.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55315.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46116.exe
      4⤵
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33721.exe
    3⤵
    PID:2396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
    3⤵
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21407.exe
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
    3⤵
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exe
    3⤵
    PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
    3⤵
    PID:6312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58872.exe
    3⤵
    PID:6216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41199.exe
    3⤵
    PID:3136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41610.exe
    3⤵
    PID:4344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
    3⤵
    PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
    3⤵
    PID:6940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe
    3⤵
    PID:7544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
  2⤵
  PID:1160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
  2⤵
  PID:3324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32592.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32592.exe
  2⤵
  PID:3700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe
  2⤵
  PID:5068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
  2⤵
  PID:5612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40914.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40914.exe
  2⤵
  PID:6052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11704.exe

Filesize
468KB

MD5
ec193d078374aaae67e27e57c8ac13dc

SHA1
40efda1c20e1f5b716f8e82c0f6ce4934b110d71

SHA256
e48eaeda43e2c18c40ecf3d20f79611272805854e15334b1eb33c50cd6740cf5

SHA512
d3558e0d3821f13a7c69604292c3e36ef624fe6dc6308ad5ccad80b43728f5ae5e8d2c7ec211c37a39a36ec832465a4c1a50c65097434fb42215e300772c9fd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe

Filesize
468KB

MD5
203397b657bb51588b50d5fdf86568a8

SHA1
f5ed64cb2da89a561c70ed1afd743852c3aa1130

SHA256
caf4b4efa85406b853435f7b85e4bb75e5a45150283536c268b0d3b1e0dfcaaa

SHA512
e938575b2f1b8f1daa9068be532111573e3ec15654329ea29eac0cf0c9fe37007b6f2c0602a42eadc3d2a7857f522d155d504bfc6cbb5a1d4c45fdbefbd885fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe

Filesize
468KB

MD5
651a5001a25bfbb9bb65329f1fb0cb8d

SHA1
41e4de350a43ac3e8b0b8431a7c41376e15b1186

SHA256
2ed3c36231f8764c45d7144a9fe6cc381ec118d0f98769e0f1d4e65a8713b769

SHA512
ff73909de0aa9efef09288f63b19e2824ca1b3301fe6835b256651d2f11331728a4c34fdc76a3e507208b8e6c1217b3d8afd343d677f92cbcd66af5cfa995a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34252.exe

Filesize
468KB

MD5
4e2b60effbe6aca178f1714cbdf61cae

SHA1
e6706bc461d26ec6e26934bb94097ca3aab0f703

SHA256
9370a2165ed4319d77cd1faa95d14b214c295e4fa20b6a8dfa5e06fe8b666bb6

SHA512
97712a452f6931ce01dbf2f1d3b997c97856caf1f28d9aec6365f3a3ac0cbb9363ce70dacc268c1fb2d36e972c0d3e7d0228de665339d1000c43a8cd6390a1c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe

Filesize
468KB

MD5
5058644ec6e992bad4964b92f6b145c6

SHA1
c384ca69a5f16d25b474cd596864cb0eb3c7dca8

SHA256
00e5fe5294051459c032b37b31c4fe6f955fb2eae63453ec24f71ffd7edcd49c

SHA512
6bb03089e149c46b3e34e6ec6fd6dbe80b7ffda4345118be494377611e8b19cd4486852df237d582a6138d4e909c8cced878a198a8d0c53f99324358ab5af1d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe

Filesize
468KB

MD5
e4e75350c81f4ca0e3a18acee905528d

SHA1
0e0739a8cec0e365629223667fe4ee4b97de0ce7

SHA256
c37bda0a45b68d70682f633d6deb33e47ffac331d8240bff24233c7d10de2f2f

SHA512
908258eb8fc5c96f39c234d78bce0898508cc0dd7529523d4445a4ae0fb6199031ed7ab5636672ecc6ebbd5669e341f292e5abffd18c78ee3f52a7489255799a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe

Filesize
468KB

MD5
1bde4c5d56e500a12dc7177914f9a442

SHA1
b68222e7ede199bf3d09c2529b4c34292eb9970f

SHA256
0e2f27b3a77cdefeb9840579448536b1db3b213a866113d6d328aef0fda5d7bc

SHA512
42311eb0ded6095aac5fd0e2ddc1f78e1fe0886c4233ca3bd991c94018513579cd661a3c469c669e760a1d6ce019fda42e687df071a6523bca3f825657b94dd8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe

Filesize
468KB

MD5
d173d3d0552bf3eb4709fd6f0712673c

SHA1
b289b0179edc14f1bcec229c0484122001520cdd

SHA256
ed816f952b0d0ab931da68598715192d756465c0f9bb29188cfbd0f025f6bae0

SHA512
f69d3e34e42a5c1a1ae04d5e22c68fa71e9a5ad235524f12767791998f6f1d2f6fbfa945a26ea3fc2e4dff25db054363abeffe29b8ed7efde2ee48eb1282b1f7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18010.exe

Filesize
468KB

MD5
3cae203ed9dd6884397d01656e8b0908

SHA1
ec60816efd60a10fe2bc819a29adc71a21c49992

SHA256
15fad982929de84ace75f8cecf7005a6538b6262073e5a42228e8cc5c064966f

SHA512
6fef1e817f5cbfca1bb867db9c866ebfe123ed5ad7a8e0291cea2a930a1dc979f6013819278a919971cdca173243c2f89f720edb707ada92eabfa0586d8e2632

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe

Filesize
468KB

MD5
30b9f9cbf211ca19ce1545838b071d9c

SHA1
fabc6c7e90dfcb990a83d87bb74ef7555ecf2662

SHA256
97c369cbc0b84ced7dada4017af1632baa4095268ce1ca532e9626c2a70816eb

SHA512
a3e0535354c2dfbc1bb0af3f397ab3a4f13e2816fd7c2f30795cd8dda0266d9755afc783a2a37367759ce22876bc750c91da56be2ca970c335f7d88a3198f7b6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19868.exe

Filesize
468KB

MD5
f50fc06503be07d907494804e81747d1

SHA1
af7d1743a86f3cef1cd0c70573f02160aaa6d47b

SHA256
27245f4aef387a7f9ccaa08f9edf955fff515333b6fe6503ed3f16b9fda4ef81

SHA512
f73cca74e3276f67a4b37a9380dafe4d8a718028e52e04637bd61ecefb8f85de641e001361aedd704a88b125ad35ec57393221c44a05618dc03384fab0766be0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe

Filesize
468KB

MD5
ee5bf90e20beb8da411e7db2d7d67813

SHA1
5026d9db3c5296f38c89dbe73e295999682d6f31

SHA256
3c9e7409ad3831a371fc84096466bb62f96949254dd6077c35909d9b16624701

SHA512
b119841ab76d504c63995cffad1d5ac7c3952c3d89b18d010af5bc9779fae73fcb226c6e000caa1ed6d79238d8f60d6d98e568b5515ad7f3f236ec2cf8412f06

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe

Filesize
468KB

MD5
fd74ea718163d351034e0b0b155ec458

SHA1
e368036be5426e7b6faebbfb45394df323d0ba89

SHA256
21e7a528ce299a343beaf35e6b7ca43faf8562597cf54733ed6c4bc195005607

SHA512
930271fa08d953b50a605d1f146c79565b99d9123dd11ba587b9236cbadbf5db57e6ebeea38568ad0d4a0cbc226804b71c1bb982291514453c5d886229fe9922

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe

Filesize
468KB

MD5
e6a42656471ce5f4152da25c952ca73c

SHA1
2cc6578de140dea802e7687ff431dbde70c6a237

SHA256
09c2d1ccc30795acb3360688569d28a6178a91b6bb22f597e2a1dee3c38ba28b

SHA512
ce30e0b04d6a88ca6cf31d4d19f87974a4fb61a0efe8701720466a2c267a1996060ee88dd932f01f86b1237ad2e4ee67543136eb48cc17ee70ac6cc1560ce29d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe

Filesize
468KB

MD5
692b0e4fd62b714b712528197735706b

SHA1
ec173b4f135a684799086a335eef853ed69c02d3

SHA256
0444711a7678956324ef80e057a39997d2cf11de7be35450ac745114684588eb

SHA512
edd3729a2f1065f5a9aedb94d8a5f906f28745968a3d21a1f01f3de4d83868c5d0e3ed5721e0bf9570a64dd45372293767a87218166f96b30b6c17afdaee04d4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36126.exe

Filesize
468KB

MD5
861acdea6af7fd71cdda711b60f674ae

SHA1
ca23310671b4cc450d77e5b13f055390e2dd83c2

SHA256
0680668735ad874b9d5d3383b1934ba735803da6febe69af3069853fd3b9dffe

SHA512
51340984ee59385399df993f126064c537a412e78d84e8c86e9fad49e40624002ce38ef9b251c9a7a615c035f37b5a81c0244c96b1030fb96071faf61ebcf4e2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe

Filesize
468KB

MD5
ff5e462215c216fd318b4d7e108af05f

SHA1
d251f1022ac2634b13345c76706abd8b2125f5d4

SHA256
e023fe4b4f0190395bc57489f83f7f22128dbcecc3fe4931c06fc8a9e8af5557

SHA512
9cc9f89c1f2ed82fd3d4dfd05445b362c41b63e40e5f604e68594e471b4715993aa0954eb36a658dc5ac91fd4e3ca6c8e765ec37e16b3ba3b76db05d925ce6b9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe

Filesize
468KB

MD5
a0acc6eb1da8d5dc8490960dd06387f1

SHA1
d2a98338bd3703d468bc11383d3066a9d8e5a4e2

SHA256
de6dbf0ef43a5eafa4a1d90b1f959ce80dabc041125a36db16c55d1df330c9dc

SHA512
37f6ef15d4387c4257b81ceb05043b0f6b104291f54ec5fa6c292ecf6dcafa7d6f97836f56f17aff6ce57703175497e09df620b6da77269b194eeca72c63a233

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe

Filesize
468KB

MD5
599c2bd212d5071c0db9ef856266bb8e

SHA1
773db5dab9ed54aa0fb492b513f0e88dc0d7809c

SHA256
29329379803675ff9e055a1591f5eb7f893fff8ba875ff35eb2c96bfb86055c5

SHA512
a4773d433aee883441e51e288ab48e150d34b11a0a638d795d4381c4b593303183bcf4d885f6d121dad8e8c8a6218e24494e3cc38d1ce5207d4f5d563aa02e80

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe

Filesize
468KB

MD5
89e4d80626ce45309bd2935192cc1003

SHA1
7598c50e179f8e9ff7311a8c75737a913320e864

SHA256
09f84e14131b09df66dcb6cd88696b1b22844122ca23e0ade5d103e80721ce13

SHA512
191cb79d8dc4be0996ea1a7fbe842f674d61efad9d3a3ec3b763cd94910a76a6c5ee431d97d48c378e6ffc139f6e3492e811fef0260d962174e41076790ce6a7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe

Filesize
468KB

MD5
341cf1eff03742169a4f129a3417c339

SHA1
1965cfdd3f0977c441270f5447c5d909e7f4c62e

SHA256
dc33c812b03b1be17f3ef9485fd8bc2288de5e23f59beba7ba9a5347f33e4a19

SHA512
f37cf28f86934237946f6f994f0cdef133067eab61a38e7961661049ccfe99017ed568759194fd0f6c22d744c41ca7672fc63dac301dcfcdc6890ef7e01ff10e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9287.exe

Filesize
468KB

MD5
eebfb5295a4eea446d0700779e18a3c9

SHA1
7dd9a631d1b598de455c783929065d43734d4ebd

SHA256
ae7afdd9a593b120b43d752b30a9b89d678fa0219c1c179ed17019b3875ba825

SHA512
c40f63addd79aae301bcdf188ff51aa2d80db0fc541217cdd678d293bd4f4260c467f8a3667f3a772ff246caadd20ebb51060d26d2f79f323bae4fbf09291f7f

Download Submit
memory/1016-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1028-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-417-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/1616-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-403-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/1788-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-398-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1820-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2140-400-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2140-396-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2140-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2140-25-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2140-229-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2140-230-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2228-156-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2228-294-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2228-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-293-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2228-134-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2228-68-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2240-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-135-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2240-332-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2240-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-158-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2240-29-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2240-6-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2240-317-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2260-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-350-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2276-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-349-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2284-211-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2284-210-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2284-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-384-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2308-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-261-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2364-273-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/2364-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-315-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2484-324-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2544-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-310-0x0000000003250000-0x00000000032C5000-memory.dmp

Filesize
468KB

Download
memory/2576-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-300-0x0000000003250000-0x00000000032C5000-memory.dmp

Filesize
468KB

Download
memory/2580-244-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2580-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-24-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2580-133-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2580-253-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2588-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-360-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/2612-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-309-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2712-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-298-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2760-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-184-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2800-179-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2800-359-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2892-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-389-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2896-387-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2896-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-228-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2896-218-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2908-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-335-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2920-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-201-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2920-200-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2944-254-0x0000000001F90000-0x0000000002005000-memory.dmp

Filesize
468KB

Download
memory/2944-242-0x0000000001F90000-0x0000000002005000-memory.dmp

Filesize
468KB

Download
memory/2944-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-260-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/3024-272-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/3044-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-287-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/3056-157-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/3056-138-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/3056-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-286-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/3056-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download