e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8

Analysis

max time kernel
101s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
Size

468KB
MD5

9a8789bc08fcadbd92188dd511a7c070
SHA1

c1877bba8878b56ea78d9f239cb538f7848b012f
SHA256

e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8
SHA512

9dfc917344effa4cc6e5a93eacf6d1f05294980208e0ea2920af6bfce7bd2a05f9553207acdc7e5fe2a087c8bef037162536e065d247d0a903ac7a6f7d8f2e40
SSDEEP

3072:mbXIogV+P88U2aYhPzijff8/EChAK4jxbdHeZVo1QV1NLEmT4ayk:mbYohRU2pPejffIuCsQVPAmT4

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2508	Unicorn-42309.exe
2884	Unicorn-16866.exe
2204	Unicorn-700.exe
2908	Unicorn-31915.exe
2584	Unicorn-24685.exe
2768	Unicorn-38421.exe
2748	Unicorn-44551.exe
2968	Unicorn-24297.exe
1536	Unicorn-13559.exe
1384	Unicorn-62013.exe
1840	Unicorn-19318.exe
2328	Unicorn-25449.exe
1924	Unicorn-25184.exe
764	Unicorn-17835.exe
2952	Unicorn-40859.exe
2216	Unicorn-33245.exe
2916	Unicorn-54071.exe
2904	Unicorn-23628.exe
2548	Unicorn-9893.exe
2556	Unicorn-49795.exe
1592	Unicorn-51502.exe
904	Unicorn-18083.exe
736	Unicorn-5830.exe
3020	Unicorn-16036.exe
1676	Unicorn-46406.exe
604	Unicorn-46671.exe
1780	Unicorn-45909.exe
112	Unicorn-54839.exe
1508	Unicorn-63370.exe
2160	Unicorn-34886.exe
2860	Unicorn-48077.exe
2844	Unicorn-2405.exe
2320	Unicorn-24287.exe
2652	Unicorn-42670.exe
2608	Unicorn-46754.exe
1104	Unicorn-26261.exe
1852	Unicorn-20395.exe
1764	Unicorn-26526.exe
1728	Unicorn-14828.exe
1936	Unicorn-32508.exe
1544	Unicorn-39053.exe
2480	Unicorn-39053.exe
888	Unicorn-52959.exe
2248	Unicorn-39629.exe
1944	Unicorn-3235.exe
696	Unicorn-23101.exe
1336	Unicorn-47989.exe
280	Unicorn-52073.exe
1776	Unicorn-41859.exe
1448	Unicorn-47027.exe
936	Unicorn-15295.exe
3040	Unicorn-35161.exe
760	Unicorn-13786.exe
2360	Unicorn-2851.exe
1628	Unicorn-22717.exe
2960	Unicorn-22452.exe
2880	Unicorn-31823.exe
2728	Unicorn-24217.exe
2836	Unicorn-53360.exe
2692	Unicorn-7688.exe
2972	Unicorn-24609.exe
2112	Unicorn-30740.exe
1428	Unicorn-47631.exe
1648	Unicorn-55436.exe

Loads dropped DLL 64 IoCs

pid	Process
2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
2508	Unicorn-42309.exe
2508	Unicorn-42309.exe
2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
2204	Unicorn-700.exe
2204	Unicorn-700.exe
2508	Unicorn-42309.exe
2508	Unicorn-42309.exe
2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
2884	Unicorn-16866.exe
2884	Unicorn-16866.exe
2908	Unicorn-31915.exe
2908	Unicorn-31915.exe
2204	Unicorn-700.exe
2204	Unicorn-700.exe
2584	Unicorn-24685.exe
2584	Unicorn-24685.exe
2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
2508	Unicorn-42309.exe
2508	Unicorn-42309.exe
2748	Unicorn-44551.exe
2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
2748	Unicorn-44551.exe
2884	Unicorn-16866.exe
2884	Unicorn-16866.exe
2968	Unicorn-24297.exe
2968	Unicorn-24297.exe
2908	Unicorn-31915.exe
2908	Unicorn-31915.exe
1536	Unicorn-13559.exe
1536	Unicorn-13559.exe
2204	Unicorn-700.exe
2204	Unicorn-700.exe
2768	Unicorn-38421.exe
2768	Unicorn-38421.exe
2328	Unicorn-25449.exe
2328	Unicorn-25449.exe
2748	Unicorn-44551.exe
2748	Unicorn-44551.exe
1840	Unicorn-19318.exe
764	Unicorn-17835.exe
1840	Unicorn-19318.exe
764	Unicorn-17835.exe
2508	Unicorn-42309.exe
2884	Unicorn-16866.exe
1924	Unicorn-25184.exe
2508	Unicorn-42309.exe
2884	Unicorn-16866.exe
1924	Unicorn-25184.exe
1384	Unicorn-62013.exe
2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
1384	Unicorn-62013.exe
2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
2584	Unicorn-24685.exe
2584	Unicorn-24685.exe
2952	Unicorn-40859.exe
2952	Unicorn-40859.exe
2968	Unicorn-24297.exe
2216	Unicorn-33245.exe
2216	Unicorn-33245.exe
2968	Unicorn-24297.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	2796	WerFault.exe	107

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2136.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
2508	Unicorn-42309.exe
2884	Unicorn-16866.exe
2204	Unicorn-700.exe
2908	Unicorn-31915.exe
2584	Unicorn-24685.exe
2768	Unicorn-38421.exe
2748	Unicorn-44551.exe
2968	Unicorn-24297.exe
1536	Unicorn-13559.exe
1840	Unicorn-19318.exe
2328	Unicorn-25449.exe
1384	Unicorn-62013.exe
764	Unicorn-17835.exe
1924	Unicorn-25184.exe
2952	Unicorn-40859.exe
2216	Unicorn-33245.exe
2548	Unicorn-9893.exe
2916	Unicorn-54071.exe
2904	Unicorn-23628.exe
2556	Unicorn-49795.exe
1592	Unicorn-51502.exe
1676	Unicorn-46406.exe
604	Unicorn-46671.exe
1780	Unicorn-45909.exe
904	Unicorn-18083.exe
736	Unicorn-5830.exe
3020	Unicorn-16036.exe
112	Unicorn-54839.exe
1508	Unicorn-63370.exe
2160	Unicorn-34886.exe
2860	Unicorn-48077.exe
2844	Unicorn-2405.exe
2320	Unicorn-24287.exe
2652	Unicorn-42670.exe
2608	Unicorn-46754.exe
1764	Unicorn-26526.exe
1104	Unicorn-26261.exe
1852	Unicorn-20395.exe
1728	Unicorn-14828.exe
1936	Unicorn-32508.exe
1544	Unicorn-39053.exe
2480	Unicorn-39053.exe
888	Unicorn-52959.exe
2248	Unicorn-39629.exe
1944	Unicorn-3235.exe
696	Unicorn-23101.exe
280	Unicorn-52073.exe
936	Unicorn-15295.exe
3040	Unicorn-35161.exe
1448	Unicorn-47027.exe
1336	Unicorn-47989.exe
1776	Unicorn-41859.exe
2360	Unicorn-2851.exe
2960	Unicorn-22452.exe
1628	Unicorn-22717.exe
760	Unicorn-13786.exe
2880	Unicorn-31823.exe
2836	Unicorn-53360.exe
2728	Unicorn-24217.exe
2692	Unicorn-7688.exe
2972	Unicorn-24609.exe
2112	Unicorn-30740.exe
1428	Unicorn-47631.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2508	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	30
PID 2084 wrote to memory of 2508	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	30
PID 2084 wrote to memory of 2508	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	30
PID 2084 wrote to memory of 2508	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	30
PID 2508 wrote to memory of 2884	2508	Unicorn-42309.exe	31
PID 2508 wrote to memory of 2884	2508	Unicorn-42309.exe	31
PID 2508 wrote to memory of 2884	2508	Unicorn-42309.exe	31
PID 2508 wrote to memory of 2884	2508	Unicorn-42309.exe	31
PID 2084 wrote to memory of 2204	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	32
PID 2084 wrote to memory of 2204	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	32
PID 2084 wrote to memory of 2204	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	32
PID 2084 wrote to memory of 2204	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	32
PID 2204 wrote to memory of 2908	2204	Unicorn-700.exe	33
PID 2204 wrote to memory of 2908	2204	Unicorn-700.exe	33
PID 2204 wrote to memory of 2908	2204	Unicorn-700.exe	33
PID 2204 wrote to memory of 2908	2204	Unicorn-700.exe	33
PID 2508 wrote to memory of 2584	2508	Unicorn-42309.exe	34
PID 2508 wrote to memory of 2584	2508	Unicorn-42309.exe	34
PID 2508 wrote to memory of 2584	2508	Unicorn-42309.exe	34
PID 2508 wrote to memory of 2584	2508	Unicorn-42309.exe	34
PID 2084 wrote to memory of 2768	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	35
PID 2084 wrote to memory of 2768	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	35
PID 2084 wrote to memory of 2768	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	35
PID 2084 wrote to memory of 2768	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	35
PID 2884 wrote to memory of 2748	2884	Unicorn-16866.exe	36
PID 2884 wrote to memory of 2748	2884	Unicorn-16866.exe	36
PID 2884 wrote to memory of 2748	2884	Unicorn-16866.exe	36
PID 2884 wrote to memory of 2748	2884	Unicorn-16866.exe	36
PID 2908 wrote to memory of 2968	2908	Unicorn-31915.exe	37
PID 2908 wrote to memory of 2968	2908	Unicorn-31915.exe	37
PID 2908 wrote to memory of 2968	2908	Unicorn-31915.exe	37
PID 2908 wrote to memory of 2968	2908	Unicorn-31915.exe	37
PID 2204 wrote to memory of 1536	2204	Unicorn-700.exe	38
PID 2204 wrote to memory of 1536	2204	Unicorn-700.exe	38
PID 2204 wrote to memory of 1536	2204	Unicorn-700.exe	38
PID 2204 wrote to memory of 1536	2204	Unicorn-700.exe	38
PID 2584 wrote to memory of 1384	2584	Unicorn-24685.exe	39
PID 2584 wrote to memory of 1384	2584	Unicorn-24685.exe	39
PID 2584 wrote to memory of 1384	2584	Unicorn-24685.exe	39
PID 2584 wrote to memory of 1384	2584	Unicorn-24685.exe	39
PID 2508 wrote to memory of 1840	2508	Unicorn-42309.exe	41
PID 2508 wrote to memory of 1840	2508	Unicorn-42309.exe	41
PID 2508 wrote to memory of 1840	2508	Unicorn-42309.exe	41
PID 2508 wrote to memory of 1840	2508	Unicorn-42309.exe	41
PID 2084 wrote to memory of 1924	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	40
PID 2084 wrote to memory of 1924	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	40
PID 2084 wrote to memory of 1924	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	40
PID 2084 wrote to memory of 1924	2084	e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe	40
PID 2748 wrote to memory of 2328	2748	Unicorn-44551.exe	42
PID 2748 wrote to memory of 2328	2748	Unicorn-44551.exe	42
PID 2748 wrote to memory of 2328	2748	Unicorn-44551.exe	42
PID 2748 wrote to memory of 2328	2748	Unicorn-44551.exe	42
PID 2884 wrote to memory of 764	2884	Unicorn-16866.exe	43
PID 2884 wrote to memory of 764	2884	Unicorn-16866.exe	43
PID 2884 wrote to memory of 764	2884	Unicorn-16866.exe	43
PID 2884 wrote to memory of 764	2884	Unicorn-16866.exe	43
PID 2968 wrote to memory of 2952	2968	Unicorn-24297.exe	44
PID 2968 wrote to memory of 2952	2968	Unicorn-24297.exe	44
PID 2968 wrote to memory of 2952	2968	Unicorn-24297.exe	44
PID 2968 wrote to memory of 2952	2968	Unicorn-24297.exe	44
PID 2908 wrote to memory of 2216	2908	Unicorn-31915.exe	45
PID 2908 wrote to memory of 2216	2908	Unicorn-31915.exe	45
PID 2908 wrote to memory of 2216	2908	Unicorn-31915.exe	45
PID 2908 wrote to memory of 2216	2908	Unicorn-31915.exe	45

C:\Users\Admin\AppData\Local\Temp\e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe
"C:\Users\Admin\AppData\Local\Temp\e91c3abfceee4a5bc072b92038ea59e51c41c0102ee62a42c98e628c402a44b8N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42309.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42309.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44551.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25449.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        8⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe
        9⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        9⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
        9⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
        8⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6619.exe
        8⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        8⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        8⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        8⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        8⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        7⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53324.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32508.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        7⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
        8⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
        8⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        8⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        7⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        6⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
        7⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        7⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        6⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61187.exe
        6⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64608.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1285.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        7⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        8⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        8⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        8⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        8⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
        8⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2867.exe
        7⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        7⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52867.exe
        6⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        7⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64658.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        7⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18295.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exe
        6⤵
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61450.exe
        5⤵
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42702.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        6⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        5⤵
        
        PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5830.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22717.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61907.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38820.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        8⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26151.exe
        8⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        7⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exe
        7⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
        6⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        7⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        6⤵
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        6⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36525.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31823.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        6⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        7⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        7⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        6⤵
        
        PID:292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53061.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5392.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32235.exe
        6⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50733.exe
        5⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        6⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30719.exe
        5⤵
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
        5⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35161.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60657.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        7⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        6⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        5⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37030.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        6⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6619.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
        5⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11085.exe
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22053.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47693.exe
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        7⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        8⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        8⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
        8⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
        7⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        7⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16193.exe
        6⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
        7⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        7⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        6⤵
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55585.exe
        5⤵
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36345.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37896.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        5⤵
        
        PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63370.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        5⤵
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31404.exe
      4⤵
      PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
      4⤵
      PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19318.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39629.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        6⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        7⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30548.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26473.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8955.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4539.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48695.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        5⤵
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
        5⤵
        
        PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        5⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4666.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
      4⤵
      PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44312.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61129.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5485.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2120.exe
        5⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
      4⤵
      PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
      4⤵
      PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
      4⤵
      PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
      4⤵
      PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2119.exe
    3⤵
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53580.exe
    3⤵
    PID:4124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
    3⤵
    PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
    3⤵
    PID:6252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24297.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34886.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        8⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
        8⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        8⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
        7⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        7⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64078.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28151.exe
        7⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        7⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48404.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        7⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        6⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7688.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
        7⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        6⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        6⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
        6⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        6⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        7⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        7⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11118.exe
        6⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        6⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61450.exe
        5⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38203.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57759.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33245.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        7⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47631.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12514.exe
        6⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5957.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        7⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19596.exe
        5⤵
        
        PID:732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        5⤵
        
        PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42033.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        5⤵
        
        PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        5⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59105.exe
        6⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44476.exe
        5⤵
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
      4⤵
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35068.exe
        5⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10953.exe
      4⤵
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47693.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
      4⤵
      PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13559.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
        6⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
        7⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
        7⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        7⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        6⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        6⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
        5⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        6⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
        5⤵
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54782.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
        5⤵
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14828.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        5⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6089.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        6⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29928.exe
      4⤵
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        5⤵
        
        PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-371.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
      4⤵
      PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
        5⤵
        Executes dropped EXE
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        6⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52675.exe
      4⤵
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
      4⤵
      PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
      4⤵
      PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
      4⤵
      PID:2796
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 200
        5⤵
        Program crash
        
        PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
      4⤵
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
      4⤵
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
      4⤵
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2925.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
      4⤵
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
      4⤵
      PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
    3⤵
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
    3⤵
    PID:5480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        5⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42799.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
      4⤵
      PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
      4⤵
      PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
      4⤵
      PID:6444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
      4⤵
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        5⤵
        
        PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11844.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34636.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
      4⤵
      PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exe
      4⤵
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47771.exe
    3⤵
    PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
      4⤵
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exe
      4⤵
      PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe
    3⤵
    PID:320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
    3⤵
    PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
    3⤵
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
    3⤵
    PID:5528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25184.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25184.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
        5⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
        5⤵
        
        PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16193.exe
      4⤵
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31772.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        5⤵
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33402.exe
      4⤵
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
      4⤵
      PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
    3⤵
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exe
      4⤵
      PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50698.exe
    3⤵
    PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
    3⤵
    PID:5568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45909.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45909.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41382.exe
    3⤵
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9520.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
      4⤵
      PID:584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe
    3⤵
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
      4⤵
      PID:6376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50698.exe
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22754.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
    3⤵
    PID:5652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47027.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47027.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exe
    3⤵
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14770.exe
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
      4⤵
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58134.exe
    3⤵
    PID:5956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29854.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29854.exe
  2⤵
  PID:1656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
    3⤵
    PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
    3⤵
    PID:6156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
  2⤵
  PID:3184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61956.exe
  2⤵
  PID:4216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56473.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56473.exe
  2⤵
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
  2⤵
  PID:5596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe

Filesize
468KB

MD5
51f34c9137d524107a38d4f0f6383aca

SHA1
d7b910905a149e51f6b14514828d0de25301f3a4

SHA256
460f63ef6123b2a3bf2abdf1499f8ebff56115da32cf520f4b67f03d9466ce88

SHA512
df6eff671d03a7b62de69b4719dfb1acc999dbe6064317d823b08b0dc003a4992137c4756e7671f3bc423780a479af2ebc0c4b83c1b7af683c79fad39a644793

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25449.exe

Filesize
468KB

MD5
93012a751ed2af170c6c3f08006a97ca

SHA1
72f5a9d805b57a8f0e54fdf2847daa5deaa1fa14

SHA256
40546651c95be2ed1e5ae9e9a9ce1ca3a54d550533888e3308e59d9b8a97d857

SHA512
b1ce2dc8b793db08ca7b9d9d6f818a302172c524ff4d297ebb2d125295413d372a1c8ec8de194925da8dc8835167157d822df4dd4c8e4f4e2830c6feaca78bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33245.exe

Filesize
468KB

MD5
6b55124ca3f0a9c46fa424f8e8310c3e

SHA1
82f4aa99e672f13571511133ba08f38093227cb7

SHA256
54b1408e3b5994da14139ff82e01519bf648ba6f511d5d7108cab12aac985e54

SHA512
74d66a098efb1a61eeddd1c67b7c6a9fbc2cb86ede0001a759fbf615a83113aab3b7bd8fa652514d04a3327249c5dc0b0e015d3afea7e88127df2fafb76410be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe

Filesize
468KB

MD5
569b7d9af24decb175125b9d321a9556

SHA1
09f64c7d283d54ca2407400e46482575f455eef7

SHA256
38796c64c521fc51896851987e524c8e53899e1284db66437b8c3c8ce307de51

SHA512
5efd7a361392fd75ac39995eff500ecf53fa8210706163c64fc03d6faf645fbfb9ed289384b5994f4022e392df78c341edded8180d026c3a190fa837504a4636

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13559.exe

Filesize
468KB

MD5
cfb72e84c7ff6b728d7fd5cd652f141f

SHA1
705775715471f316c1e45f4f4ec22c4b4ebf249a

SHA256
b6b9e78d5b1b39c23979fa6245897b9b8e98056943785c08c7ce12bdcb3d4936

SHA512
eb39d0b430e5924bd71059b95e578c34b7d6be3da282bc54c75ba2ddab11426207aa74e91f49b1a5c43ff79b0fe3d3a5595a99f07cd588200cf64b1e1d9efaef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe

Filesize
468KB

MD5
dd3da03ed48efaca29df420dde858e2d

SHA1
350e13303cb8e04e943dfdb44aa9405f23c8d8b9

SHA256
b0b7e29d6bb6372fc4a6caa64e7d948d130d5d7431a8dabb97b32ed251f96165

SHA512
0d1867208627cc3b930946d0e25f6cab66cffc5c332ce8512ee7a925312f0d906a2eaf6eb791bb1900e24fa953de44d8100a829a64e9d2fac5b98a7df4fedee6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe

Filesize
468KB

MD5
7bbb3cf9b37b8f1c2425a619d199cde1

SHA1
cbef4852b9204cd6ca947421e7cebc8af316add2

SHA256
35251c16486b3fc27214a4d060092e72e3b38f8656f23df4e1868d16ee246df7

SHA512
b8cdc6f96859aefd2da3cfbb3f461954a03276047c618ab2eb9e7d2df0ded1facc42d828504be41d64b22680ecea5e4fb7b7f95c9db9aa790c8720785c842a36

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19318.exe

Filesize
468KB

MD5
415eccd9646447c3565107bd46f63e3c

SHA1
78310bcfb6aeea0bb3f55fe85eadd0112200df07

SHA256
3d5d8876a170b28ec44e990de3df6fcff9af3c6c4d65eb0d4f735543335e6ba5

SHA512
183790fe8f9349598720da711b6506ec957d5a5216c5992191f0654a9995269b71a84b1f3a14e42408e18d61a056791e2c9fef25b3a94fbb4d49218bdadc6b23

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe

Filesize
468KB

MD5
484563619d57dca3d28e2610832cfd4e

SHA1
bca327df6443feee35d4572bdd3eaf453b05a59f

SHA256
64fa7641ba7928a7605d2f269ae04a4d1902b072c588019f1a07601ff4c9beb2

SHA512
c3794015d6866bcbd1ad5ac9e2a925601643a0bba5455dcb3f8824d909117cfa5c51e77505fcb80889b85262d01e3cf741da497bda35a2e5b76309a4ac67aa7d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24297.exe

Filesize
468KB

MD5
163cde4f82a97b16b6273fe51c28990b

SHA1
cdd39626bc5745f774ffd437b79dde2a32a1a2ef

SHA256
ba6502fbaf65b46240a3bcce16e74a052c932e1176633c034c21dc9bcde96cbd

SHA512
c9047b84019278b43a00ca50e8cca8719ad4d02dc6836d455ed5bdfbfed310eb688915a69ced10d38fb891ed50050ec8a4730b315545315263f1ef361a341bfc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe

Filesize
468KB

MD5
89816cff100050e621554fb495417297

SHA1
0691a217005565d9870ac8449f1fe7b13a3d21fc

SHA256
e0ac81b1f3e56cc5b70ac010e7a661b7c7abb4d944c0840f49eb059caf61557a

SHA512
28c7b615c3156c4a811b7f294ced2f4e18664e56d5ded8f33c225e6aa5e7b2eb97c124bd0db2aab88d3f4d1f51b6ef3230815037ac055bcb77eb9ad604f5a740

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25184.exe

Filesize
468KB

MD5
ceef01257d317f46175fd23f938e4342

SHA1
99b880ca199ee37f58d077e14a6b635ee2c2aa4f

SHA256
8cc68fe1d6a281d2192326b54e130901d30236b058ef8f4d0d8eeaabfc17f425

SHA512
4aa92f2af46b158f27996c1765e5e2a2c6f1757f97d440e8dcd95cdad921b6028d8f12e04280156b2560428caf2379a36fcdea41b4edb386503f9676eb6fb2d6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe

Filesize
468KB

MD5
64f9ed156d1101ce04c2590369e4a65c

SHA1
b2758061c132a2876ca0ea5c6dd6162562755203

SHA256
0052825b47174db1826eaa3bcdeb3c31a9061719fb2da29d6feacb1b447efca4

SHA512
a8169d5cc617d6fcd271035758ab09a6cedbf2f22a26b8aab5062efe6a6215da795c2cdba323e4b1ba2215d97674d2a275df4a46a825aa3b1034852f1f60efcc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe

Filesize
468KB

MD5
9843cd1aef88f3808f0034c2cd9357a4

SHA1
e9f1fc1c6abd2e5bdc2ad8c5efba933cb407f2bc

SHA256
46dd7388872049437b5e72bafb8eaf742c317801cb1814311752771bf37e52b0

SHA512
89055e5c18332e6a153b198bcf1b97797fb9d433c5c0c94757e9a5a0104458cf467e657cf9e5d122689214d585156ebf7593d6cc6f848bbfe138a967f92e8f96

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42309.exe

Filesize
468KB

MD5
ceffa5105fb4392005ef3815319b5e61

SHA1
6ddce48f83843b28ba5e19e01cb8a811bde1d6f0

SHA256
ce2f77154636a6b2076c942442c9ef655d3fb8d734b31936ef5615568aff6310

SHA512
e341346b80fe78cfed0300f367293b290d847e0845feceb7716a434cfe985c1f9f9da7cae0d90e96b5ac15f1a73c7a74ea81818ffc6a83b262efdf59e5bf0592

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44551.exe

Filesize
468KB

MD5
084d8f4c1ca41ff736db8f913cb95a33

SHA1
68731b1d94e5e289f355d61568154fcbc962ee85

SHA256
b814156192209b81a742cf674013e3a5c6556db3a6a797994597449e43e028bb

SHA512
02b2c7016303836c83a0999af27f0e0f1e397adf9598d6efcff4c7ae539f1013fbb0212b54a5d93a6a393c6a34925a4b9a8f97cc071765d3205a977225dfcf6c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe

Filesize
468KB

MD5
863d3036255edef8e28a25027a015ea9

SHA1
f29c18cdcd8098720375c439130e6e9d53c54183

SHA256
e7b819b938665fb2aaf164a51df66736f9225893431a175a321be05dcd3d238d

SHA512
c43b96d7d44722b47f9cfe0172138f674d903bfa2b28c5c4fe64c6fb1bdeb1c1d677123c89833c6ce2342d8d44164095b746ddb6d9aab268ba519954a13c6998

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe

Filesize
468KB

MD5
3975d9698ccdbb95fb6b2701dc2942ad

SHA1
ca6dec6439ce70cfa1b98246d54e8dd9c960ac7c

SHA256
1b1a41777381dd4a57b7ae46cc6b26bb682f1a2ebb90d3d3dbad79509dfcf098

SHA512
69c058dbec549806144f5aabdc8e8626f1235a1f2de7e8850d057dc329d19cf044ef16fadc012bd86cf3ba36bbdaf84f1b6e86f28433f8bdea7ea15683400b5e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-700.exe

Filesize
468KB

MD5
eebdade8f5f887208c85cc503c53ac4c

SHA1
7cbdb1147e47274d2350bddd2b20bd9bc3f9ec38

SHA256
6388ba039a21a1ca3fc8265d31a0ed7d768ea4330142bda4bad08bf498bc1997

SHA512
5de8f5b79765ad31d5b7f0df1199fcb69f7dcd22666e1718d8d0a6446c5c6848cfb3d7095d8375761e847009395dd415ac9dd737ef3e5a063727bfc2f13d3353

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe

Filesize
468KB

MD5
5b3e39e5ed5e5d915e9cd867829b57f6

SHA1
99c66e5741acd4b2347736303c15d1a65c54ba17

SHA256
3b98f245605e37f2f7dccc0f03496457ace364b0a0358d292e11ceb1ada2a8c8

SHA512
9c8dc308b78042b80fbd17f72e3b4f767cb340658b1e419312bafd10765ecd24e17d6346f126551b129dbcd1cb3044ecf18a84606dbe92342dba4f5d891d3f0c

Download Submit
memory/112-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/604-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/736-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/764-260-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/764-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/764-277-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/904-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1104-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-309-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1384-297-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1508-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-423-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/1536-210-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/1536-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-212-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/1592-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-271-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/1840-258-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/1840-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-293-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1924-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-291-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2084-408-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2084-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-6-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2084-32-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2084-310-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2084-31-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2084-144-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2084-147-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2084-299-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/2160-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-221-0x00000000023C0000-0x0000000002435000-memory.dmp

Filesize
468KB

Download
memory/2204-410-0x00000000023C0000-0x0000000002435000-memory.dmp

Filesize
468KB

Download
memory/2204-41-0x00000000023C0000-0x0000000002435000-memory.dmp

Filesize
468KB

Download
memory/2204-418-0x00000000023C0000-0x0000000002435000-memory.dmp

Filesize
468KB

Download
memory/2204-222-0x00000000023C0000-0x0000000002435000-memory.dmp

Filesize
468KB

Download
memory/2204-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-359-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2216-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2320-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-245-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2328-243-0x0000000003380000-0x00000000033F5000-memory.dmp

Filesize
468KB

Download
memory/2328-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-434-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/2508-145-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2508-295-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2508-17-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2508-61-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2508-290-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2508-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-146-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2548-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-379-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/2556-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2584-314-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/2584-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-250-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2748-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-149-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2768-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-225-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2768-230-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2768-409-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2768-419-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2844-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-292-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2884-159-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2884-164-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2884-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-384-0x0000000000540000-0x00000000005B5000-memory.dmp

Filesize
468KB

Download
memory/2904-385-0x0000000000540000-0x00000000005B5000-memory.dmp

Filesize
468KB

Download
memory/2908-367-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2908-198-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2908-199-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2908-377-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2916-413-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2916-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-341-0x0000000003380000-0x00000000033F5000-memory.dmp

Filesize
468KB

Download
memory/2968-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-360-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2968-349-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2968-179-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2968-186-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/3020-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download