99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
Size

468KB
MD5

aab702c9ba78bd1175338d32a0f1614d
SHA1

8d4f055cc5d1bff438c5370f138e60438b968e93
SHA256

99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197
SHA512

453c9b6e068a9faa169475e77a76ec544c81bbfeb6edcf8f5515f9d2b703086ebe1cfed5d5485ff70df22ad3aeea5709e39d248a77db51b4ff7c83633834dab2
SSDEEP

3072:ZTANoSCVIduUUbYBPzt1cf8/iCMktgpwVmHeevsMUAu8LTkaQTld:ZTqoQMUUiPJ1cfmcQeUAnnkaQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1588	Unicorn-337.exe
2768	Unicorn-20787.exe
2780	Unicorn-921.exe
2948	Unicorn-45966.exe
2560	Unicorn-61233.exe
2524	Unicorn-55679.exe
2628	Unicorn-9271.exe
564	Unicorn-302.exe
1420	Unicorn-61459.exe
2680	Unicorn-64303.exe
2820	Unicorn-16748.exe
2904	Unicorn-16748.exe
2208	Unicorn-56419.exe
2280	Unicorn-40131.exe
1720	Unicorn-20530.exe
2684	Unicorn-52394.exe
2004	Unicorn-65201.exe
1856	Unicorn-20298.exe
2308	Unicorn-19232.exe
2252	Unicorn-56691.exe
2644	Unicorn-24595.exe
2336	Unicorn-18464.exe
1484	Unicorn-57651.exe
2980	Unicorn-4045.exe
2300	Unicorn-58647.exe
884	Unicorn-45648.exe
3036	Unicorn-61034.exe
1556	Unicorn-61299.exe
1660	Unicorn-27449.exe
1384	Unicorn-7583.exe
3056	Unicorn-7391.exe
2012	Unicorn-5072.exe
3044	Unicorn-61455.exe
2172	Unicorn-64107.exe
2708	Unicorn-23358.exe
1276	Unicorn-49032.exe
1596	Unicorn-62799.exe
2092	Unicorn-17128.exe
2080	Unicorn-60360.exe
2604	Unicorn-61393.exe
2716	Unicorn-59125.exe
2648	Unicorn-17294.exe
2464	Unicorn-63733.exe
2572	Unicorn-61751.exe
2508	Unicorn-61751.exe
2096	Unicorn-1245.exe
1988	Unicorn-21111.exe
1676	Unicorn-21111.exe
1016	Unicorn-14980.exe
1428	Unicorn-5770.exe
2704	Unicorn-673.exe
2700	Unicorn-6803.exe
2188	Unicorn-11898.exe
676	Unicorn-37364.exe
2520	Unicorn-37364.exe
2936	Unicorn-37364.exe
1916	Unicorn-29201.exe
1684	Unicorn-48971.exe
1664	Unicorn-35235.exe
1932	Unicorn-55101.exe
1908	Unicorn-22813.exe
1864	Unicorn-36003.exe
2324	Unicorn-51297.exe
2860	Unicorn-29030.exe

Loads dropped DLL 64 IoCs

pid	Process
2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
1588	Unicorn-337.exe
1588	Unicorn-337.exe
2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
2780	Unicorn-921.exe
2768	Unicorn-20787.exe
2768	Unicorn-20787.exe
2780	Unicorn-921.exe
2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
1588	Unicorn-337.exe
2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
1588	Unicorn-337.exe
2948	Unicorn-45966.exe
2948	Unicorn-45966.exe
2768	Unicorn-20787.exe
2768	Unicorn-20787.exe
2628	Unicorn-9271.exe
2628	Unicorn-9271.exe
2524	Unicorn-55679.exe
2560	Unicorn-61233.exe
2524	Unicorn-55679.exe
2560	Unicorn-61233.exe
1588	Unicorn-337.exe
1588	Unicorn-337.exe
2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
2780	Unicorn-921.exe
2780	Unicorn-921.exe
564	Unicorn-302.exe
564	Unicorn-302.exe
2948	Unicorn-45966.exe
2948	Unicorn-45966.exe
1420	Unicorn-61459.exe
1420	Unicorn-61459.exe
2768	Unicorn-20787.exe
2768	Unicorn-20787.exe
1720	Unicorn-20530.exe
1720	Unicorn-20530.exe
2904	Unicorn-16748.exe
2904	Unicorn-16748.exe
2780	Unicorn-921.exe
2780	Unicorn-921.exe
2280	Unicorn-40131.exe
2280	Unicorn-40131.exe
2560	Unicorn-61233.exe
2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
2560	Unicorn-61233.exe
2208	Unicorn-56419.exe
2208	Unicorn-56419.exe
1588	Unicorn-337.exe
1588	Unicorn-337.exe
2820	Unicorn-16748.exe
2820	Unicorn-16748.exe
2680	Unicorn-64303.exe
2524	Unicorn-55679.exe
2680	Unicorn-64303.exe
2524	Unicorn-55679.exe
2628	Unicorn-9271.exe
2628	Unicorn-9271.exe
2684	Unicorn-52394.exe
2684	Unicorn-52394.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
996	2860	WerFault.exe	91
5088	4536	WerFault.exe	305
5100	4528	WerFault.exe	304

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46082.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
1588	Unicorn-337.exe
2768	Unicorn-20787.exe
2780	Unicorn-921.exe
2948	Unicorn-45966.exe
2560	Unicorn-61233.exe
2524	Unicorn-55679.exe
2628	Unicorn-9271.exe
564	Unicorn-302.exe
1420	Unicorn-61459.exe
2680	Unicorn-64303.exe
2904	Unicorn-16748.exe
2820	Unicorn-16748.exe
2208	Unicorn-56419.exe
2280	Unicorn-40131.exe
1720	Unicorn-20530.exe
2684	Unicorn-52394.exe
2004	Unicorn-65201.exe
1856	Unicorn-20298.exe
2308	Unicorn-19232.exe
2252	Unicorn-56691.exe
2336	Unicorn-18464.exe
1484	Unicorn-57651.exe
2644	Unicorn-24595.exe
2980	Unicorn-4045.exe
2300	Unicorn-58647.exe
884	Unicorn-45648.exe
1556	Unicorn-61299.exe
3036	Unicorn-61034.exe
1660	Unicorn-27449.exe
1384	Unicorn-7583.exe
3056	Unicorn-7391.exe
2012	Unicorn-5072.exe
3044	Unicorn-61455.exe
2172	Unicorn-64107.exe
1596	Unicorn-62799.exe
2708	Unicorn-23358.exe
1276	Unicorn-49032.exe
2092	Unicorn-17128.exe
2080	Unicorn-60360.exe
2604	Unicorn-61393.exe
2716	Unicorn-59125.exe
2648	Unicorn-17294.exe
2464	Unicorn-63733.exe
2508	Unicorn-61751.exe
2096	Unicorn-1245.exe
2572	Unicorn-61751.exe
1016	Unicorn-14980.exe
1988	Unicorn-21111.exe
1676	Unicorn-21111.exe
1428	Unicorn-5770.exe
2700	Unicorn-6803.exe
2704	Unicorn-673.exe
2520	Unicorn-37364.exe
676	Unicorn-37364.exe
2188	Unicorn-11898.exe
2936	Unicorn-37364.exe
1916	Unicorn-29201.exe
1664	Unicorn-35235.exe
1932	Unicorn-55101.exe
1684	Unicorn-48971.exe
1908	Unicorn-22813.exe
1864	Unicorn-36003.exe
2324	Unicorn-51297.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1588	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	28
PID 2792 wrote to memory of 1588	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	28
PID 2792 wrote to memory of 1588	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	28
PID 2792 wrote to memory of 1588	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	28
PID 1588 wrote to memory of 2768	1588	Unicorn-337.exe	29
PID 1588 wrote to memory of 2768	1588	Unicorn-337.exe	29
PID 1588 wrote to memory of 2768	1588	Unicorn-337.exe	29
PID 1588 wrote to memory of 2768	1588	Unicorn-337.exe	29
PID 2792 wrote to memory of 2780	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	30
PID 2792 wrote to memory of 2780	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	30
PID 2792 wrote to memory of 2780	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	30
PID 2792 wrote to memory of 2780	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	30
PID 2768 wrote to memory of 2948	2768	Unicorn-20787.exe	32
PID 2768 wrote to memory of 2948	2768	Unicorn-20787.exe	32
PID 2768 wrote to memory of 2948	2768	Unicorn-20787.exe	32
PID 2768 wrote to memory of 2948	2768	Unicorn-20787.exe	32
PID 2780 wrote to memory of 2560	2780	Unicorn-921.exe	31
PID 2780 wrote to memory of 2560	2780	Unicorn-921.exe	31
PID 2780 wrote to memory of 2560	2780	Unicorn-921.exe	31
PID 2780 wrote to memory of 2560	2780	Unicorn-921.exe	31
PID 2792 wrote to memory of 2524	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	33
PID 2792 wrote to memory of 2524	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	33
PID 2792 wrote to memory of 2524	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	33
PID 2792 wrote to memory of 2524	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	33
PID 1588 wrote to memory of 2628	1588	Unicorn-337.exe	34
PID 1588 wrote to memory of 2628	1588	Unicorn-337.exe	34
PID 1588 wrote to memory of 2628	1588	Unicorn-337.exe	34
PID 1588 wrote to memory of 2628	1588	Unicorn-337.exe	34
PID 2948 wrote to memory of 564	2948	Unicorn-45966.exe	35
PID 2948 wrote to memory of 564	2948	Unicorn-45966.exe	35
PID 2948 wrote to memory of 564	2948	Unicorn-45966.exe	35
PID 2948 wrote to memory of 564	2948	Unicorn-45966.exe	35
PID 2768 wrote to memory of 1420	2768	Unicorn-20787.exe	36
PID 2768 wrote to memory of 1420	2768	Unicorn-20787.exe	36
PID 2768 wrote to memory of 1420	2768	Unicorn-20787.exe	36
PID 2768 wrote to memory of 1420	2768	Unicorn-20787.exe	36
PID 2628 wrote to memory of 2680	2628	Unicorn-9271.exe	37
PID 2628 wrote to memory of 2680	2628	Unicorn-9271.exe	37
PID 2628 wrote to memory of 2680	2628	Unicorn-9271.exe	37
PID 2628 wrote to memory of 2680	2628	Unicorn-9271.exe	37
PID 2524 wrote to memory of 2820	2524	Unicorn-55679.exe	38
PID 2524 wrote to memory of 2820	2524	Unicorn-55679.exe	38
PID 2524 wrote to memory of 2820	2524	Unicorn-55679.exe	38
PID 2524 wrote to memory of 2820	2524	Unicorn-55679.exe	38
PID 2560 wrote to memory of 2904	2560	Unicorn-61233.exe	39
PID 2560 wrote to memory of 2904	2560	Unicorn-61233.exe	39
PID 2560 wrote to memory of 2904	2560	Unicorn-61233.exe	39
PID 2560 wrote to memory of 2904	2560	Unicorn-61233.exe	39
PID 1588 wrote to memory of 2208	1588	Unicorn-337.exe	40
PID 1588 wrote to memory of 2208	1588	Unicorn-337.exe	40
PID 1588 wrote to memory of 2208	1588	Unicorn-337.exe	40
PID 1588 wrote to memory of 2208	1588	Unicorn-337.exe	40
PID 2792 wrote to memory of 2280	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	41
PID 2792 wrote to memory of 2280	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	41
PID 2792 wrote to memory of 2280	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	41
PID 2792 wrote to memory of 2280	2792	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	41
PID 2780 wrote to memory of 1720	2780	Unicorn-921.exe	42
PID 2780 wrote to memory of 1720	2780	Unicorn-921.exe	42
PID 2780 wrote to memory of 1720	2780	Unicorn-921.exe	42
PID 2780 wrote to memory of 1720	2780	Unicorn-921.exe	42
PID 564 wrote to memory of 2684	564	Unicorn-302.exe	43
PID 564 wrote to memory of 2684	564	Unicorn-302.exe	43
PID 564 wrote to memory of 2684	564	Unicorn-302.exe	43
PID 564 wrote to memory of 2684	564	Unicorn-302.exe	43

C:\Users\Admin\AppData\Local\Temp\99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
"C:\Users\Admin\AppData\Local\Temp\99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20787.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-302.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52394.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5072.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29030.exe
        8⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 240
        9⤵
        Program crash
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
        8⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        8⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        8⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
        8⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        7⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        8⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        8⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        8⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        8⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        8⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        7⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57694.exe
        7⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
        8⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        8⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        8⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
        8⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        8⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe
        7⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18838.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
        7⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        7⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        6⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        7⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        7⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        7⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exe
        6⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61086.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
        6⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
        6⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65201.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
        8⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        8⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        8⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36110.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
        7⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38714.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        6⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        7⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        7⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15308.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32779.exe
        6⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
        6⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52652.exe
        6⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62600.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        7⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
        6⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        5⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39520.exe
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        6⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18143.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6618.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43553.exe
        5⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        5⤵
        
        PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        7⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        8⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        8⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40409.exe
        8⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
        8⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13600.exe
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        7⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        7⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        6⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42393.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54304.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe
        6⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62799.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        6⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        7⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        6⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        5⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        6⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        6⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        6⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2516.exe
        5⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61086.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61574.exe
        5⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
        5⤵
        
        PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
        6⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        7⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
        6⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        6⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
        6⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7766.exe
        5⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        5⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60360.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        5⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61196.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11693.exe
        6⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        5⤵
        
        PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59155.exe
      4⤵
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        5⤵
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        5⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
        5⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        5⤵
        
        PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4439.exe
      4⤵
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
      4⤵
      PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
      4⤵
      PID:7956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
      4⤵
      PID:8020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        7⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        8⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        8⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        8⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37460.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41043.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
        7⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        6⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        6⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52884.exe
        6⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17643.exe
        6⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        6⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        5⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        5⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        5⤵
        
        PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60187.exe
        6⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13600.exe
        7⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        6⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        6⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        6⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
        5⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        5⤵
        
        PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-673.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59513.exe
        5⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
        6⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe
        6⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        6⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29736.exe
        6⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
        5⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13688.exe
        5⤵
        
        PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
      4⤵
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9544.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        5⤵
        
        PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
      4⤵
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
      4⤵
      PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23503.exe
      4⤵
      PID:7504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63550.exe
        6⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        7⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        6⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        6⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29133.exe
        5⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
        6⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
        7⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        6⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10651.exe
        5⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        6⤵
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        6⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64310.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
        5⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
        5⤵
        
        PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
        5⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55175.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe
        6⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        6⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37460.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        5⤵
        
        PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
      4⤵
      PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
      4⤵
      PID:8076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
        5⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        6⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46213.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36110.exe
        6⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
        5⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        5⤵
        
        PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
      4⤵
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        5⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        5⤵
        
        PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
      4⤵
      PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
      4⤵
      PID:8176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29201.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
      4⤵
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        5⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21971.exe
      4⤵
      PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10116.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
      4⤵
      PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
    3⤵
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
      4⤵
      PID:8156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
    3⤵
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
    3⤵
    PID:4616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53789.exe
    3⤵
    PID:5776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10113.exe
    3⤵
    PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
    3⤵
    PID:8060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-921.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-921.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61233.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
        7⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        8⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11084.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        7⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22577.exe
        6⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        7⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58511.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        7⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58298.exe
        7⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        7⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22608.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        6⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        6⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56605.exe
        6⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61473.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        7⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        6⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        5⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61618.exe
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        5⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        5⤵
        
        PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58647.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        6⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        7⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30135.exe
        7⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27508.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28365.exe
        5⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1893.exe
        6⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        5⤵
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        5⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        5⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        5⤵
        
        PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48971.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24708.exe
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20328.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41184.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10051.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21823.exe
        6⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        5⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        5⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        5⤵
        
        PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
      4⤵
      PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37460.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52911.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5042.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
      4⤵
      PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
      4⤵
      PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
      4⤵
      PID:8140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20530.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61393.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        7⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        6⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32786.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        6⤵
        
        PID:476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36836.exe
        5⤵
        
        PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 188
        6⤵
        Program crash
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35935.exe
        5⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        5⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
        5⤵
        
        PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59125.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        5⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
        6⤵
        
        PID:340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        5⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        5⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        5⤵
        
        PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24747.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47016.exe
        5⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
        5⤵
        
        PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64310.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38938.exe
      4⤵
      PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
      4⤵
      PID:7976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18464.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24708.exe
        5⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65218.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        6⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37460.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33456.exe
      4⤵
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55175.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13158.exe
        5⤵
        
        PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
      4⤵
      PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46802.exe
      4⤵
      PID:7300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
      4⤵
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        5⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17826.exe
        5⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
        5⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
      4⤵
      PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51761.exe
    3⤵
    PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
      4⤵
      PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38993.exe
      4⤵
      PID:7792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
    3⤵
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
    3⤵
    PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
    3⤵
    PID:6752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
    3⤵
    PID:7276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55679.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61299.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        6⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe
        6⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29736.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42143.exe
        5⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1983.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        5⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        5⤵
        
        PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22397.exe
        5⤵
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        5⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
        5⤵
        
        PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
      4⤵
      PID:288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
      4⤵
      PID:8152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
        5⤵
        
        PID:600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        6⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        6⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        5⤵
        
        PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
        5⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46169.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
      4⤵
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61113.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        5⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5297.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        5⤵
        
        PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56253.exe
      4⤵
      PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
      4⤵
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58866.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      4⤵
      PID:7904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
    3⤵
    PID:356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
      4⤵
      PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
      4⤵
      PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
      4⤵
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34035.exe
    3⤵
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50415.exe
    3⤵
    PID:4700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
    3⤵
    PID:5192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
    3⤵
    PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4259.exe
    3⤵
    PID:7240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
        5⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        6⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40275.exe
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exe
        5⤵
        
        PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
      4⤵
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63035.exe
        5⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        5⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
      4⤵
      PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
      4⤵
      PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
      4⤵
      PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
      4⤵
      PID:7624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63733.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10353.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
      4⤵
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
      4⤵
      PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
      4⤵
      PID:8052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34975.exe
    3⤵
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
      4⤵
      PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      4⤵
      PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      4⤵
      PID:8084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
    3⤵
    PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
    3⤵
    PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
    3⤵
    PID:7724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6803.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24827.exe
      4⤵
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        5⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
        5⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
        5⤵
        
        PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
      4⤵
      PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
      4⤵
      PID:7748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
    3⤵
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7361.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63176.exe
      4⤵
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
      4⤵
      PID:7188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7064.exe
    3⤵
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
    3⤵
    PID:4528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 188
      4⤵
      Program crash
      PID:5100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
    3⤵
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38084.exe
    3⤵
    PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5827.exe
    3⤵
    PID:7980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
    3⤵
    PID:7320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11898.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11898.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42909.exe
    3⤵
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
      4⤵
      PID:852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61904.exe
      4⤵
      PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34261.exe
    3⤵
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22844.exe
    3⤵
    PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
    3⤵
    PID:7216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52291.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52291.exe
  2⤵
  PID:1236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
    3⤵
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
    3⤵
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
    3⤵
    PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7251.exe
    3⤵
    PID:6404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
  2⤵
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
  2⤵
  PID:3692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55485.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55485.exe
  2⤵
  PID:4372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
  2⤵
  PID:5296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe

Filesize
468KB

MD5
af2e3298fffed82fdce7a299549f7950

SHA1
d64d56a621e8337d9718d435efbcde8b0fb3de81

SHA256
6b46867bea34cced9bc4b15a62c374e6c0d61343274d7c7a6a67c79f26dfd30b

SHA512
d6d7abdcd2f3bddd7c2f72ebe2bf8ca42a35675f86b7f07b9f7b9d7a459ca4ab3907a42287c0c37c0b1329d35f8e33912caadc66872cd8c9638ff887413eb3e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5042.exe

Filesize
468KB

MD5
2a8d4103fb3de70f5b297a95c8158885

SHA1
775c6b32ecd363861030eac3e030493df87268ae

SHA256
c4b6531e91c27c2d1ef89da5be4ba09e878e883694e3e70e9d7a66da72693a4c

SHA512
5d9926ec6653afc36daf618c8625422d7c65053f4c046eae56f69afff27ceb17ea20eaf2385962215330215b6ffa60f690aea5336c635fc7bd7e14344856fc80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe

Filesize
468KB

MD5
a434c9231adb7ca8866e8a8db5aa3469

SHA1
c406a43e65f18b9925b14edc66629774212ab59e

SHA256
fcde2a688897505febfd58bbaa34829d723ceed0c05c352f5cbf4c40a52175cf

SHA512
3470a644d97f04755623b8c13c0c46a2318a0f3621d90c44b33ed903c8817cb83820cd8f757f145541eab3a39bff532de1e872f828e08cc29812ec79fb130ca1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe

Filesize
468KB

MD5
da42e64bfa026f3216a0962b7091fad7

SHA1
15184a93758397880bcdacc628bd71a4a7fefad7

SHA256
d54f476d30c914b6ed9bdbfb86e4c0695169859a6faa5f836d6f4ffccbaa427f

SHA512
db76939d52b90d91ec7af48bcd4ac174012a89efc284eae25bf0bf2b1e8d04eeea7f7f55d3f85172e641eef7e45afa4d735dcb2335b0f7bd7be369289637f87f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe

Filesize
468KB

MD5
3a6491dc27a752599c92a771374381ac

SHA1
1d8fe0490ae608497773ccc58a62ea821d333b71

SHA256
83ed76c29c70e273f52fe7e7cfa836b60559ced16b444d7315f6bf5bd0598974

SHA512
af4f28a558a297f2f71e71f8a853e6edad28c7d8fa21600441ecb129e31249fdcfb19d6dd599350a796eb523bd11c4d8a95780ddc64d947f8c1faadf0b988dd5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20530.exe

Filesize
468KB

MD5
6d1e533dc4b0ea578154f61bf13772f2

SHA1
80859d0d643326c57cca6bd3e7cf16fbb2cb73d3

SHA256
95790a7f3554ddece8bc2f9d65294afe26d453408150d4633e57028960a3d40f

SHA512
0a2726a5fa063176f3e914b09b7396e14e58daa2339b685fe60c5bbd7cd0e4c26f23518074e3f7b954b5d7261c00673bb5d5f6df198cdd64c9feb6a7b1c2e4a1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20787.exe

Filesize
468KB

MD5
94d9ff976a1cc5e2a64fc994ccb48304

SHA1
88258531730ab5ac650f8e861322039830db9c72

SHA256
673312861d877bc08587c9ee7bb686ab59c118072e61bd55c3bad3a0acac9097

SHA512
207652b29f5002ca2001c21af6d249fd2a18efb71a422820fdb50aff7238dd2f1a839a6cf1535caed9650fb20a917e6da25963356a782ea7fd6c9b0b45c6f953

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-302.exe

Filesize
468KB

MD5
d933adb8fa271da493cc218dd18b7371

SHA1
08edc865bba79f4a52ea6ab38fb2a6028508237c

SHA256
d4c9f9501e590be238827603893cdecfac97a70cc51c83919c1b7d7883c11875

SHA512
92743c70ba9a0e482e9a50c37ef233afb0726937e71e84bd4fbae66e0a01aec892ec6748468dfbe2e39c5580d9890058d5c7103720fd53eb549a8829d6e40a16

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-337.exe

Filesize
468KB

MD5
6ec7a9b2e5c6f7f6b465659fd1960336

SHA1
2597a13e97b1c23380c4546ab4f4ffc1592ca4aa

SHA256
aaa30202529b3003c233e4820f5ac5692275777d0585ce4131597fce39952694

SHA512
fae7cada5b1a42ac21faf51de6c0974cad793f466ecf3c82894135a55ccdc95c5ab539309862907095a02107c00f5a47114a15a6ee1e141630550b95de267dba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe

Filesize
468KB

MD5
9bf9ef304105f8649ccdc2a89d47d63f

SHA1
d9872b5f59b0f04320fa7fd8ae7165e5b7a4930e

SHA256
94d9dba04b92ff992050e38a0f2e724904e30723772fcf5320e017d398dab41e

SHA512
bd41d488f1ffc3a9b4d6ecb4ebc3b58f0d953f0d5c89d8379dfe13c1581dd709842d75c36256a7973771ac1f0f59cb9782b2190da2f6160391d45b91c9583b39

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe

Filesize
468KB

MD5
af3a97165e244cad9e199fa885433036

SHA1
88ed8687e5c2c53a74fc86afb92299791c99ba8e

SHA256
2c9360e6ff4cdac8cee474d5f31db73c4286a2674e4d26e3b738cbf6f13b6adf

SHA512
413c3ededfe08c63442492423085ec211ec6533f81442d87bdf99f9e6a0b78be608287ec24e8cd0c45156e5e2a8f674e9f3182007841e441b79c9315c99e0681

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52394.exe

Filesize
468KB

MD5
a007e793da58afc58310bb40ce98b2d9

SHA1
8a0e67016947bb24a791d2c9bbe8b0dfc083f869

SHA256
2ac0dc1091e2e49727dbbf0080a935a397d4b192c5fdc09b28de38a85d690685

SHA512
e4becf0d45ddb5d8327c739de109f906b1162c0b0c163adf829aeb7b42a9ca91f9b9693b4c603e5b707094b23fc455bb774f3c2dc0ad32d9c5d93c8018cf2941

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55679.exe

Filesize
468KB

MD5
c9745f915181ffb278c71b4359fa3d2d

SHA1
d83c48c6b359e2ae51d914629de1abaab8cd6269

SHA256
edac72ad4b2d7c9f151c7289ea24ced5ab0d54db9a9646053f47880707e5c85b

SHA512
9c183faaee78cf6810d9e9c2c15fc4d444155bd7efca5b6a54a55ef987233446cb1ba645c9240312066191402a1916004b3f3cab7c1624c6f2e56ed851b7589b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61233.exe

Filesize
468KB

MD5
b3037c57ab2fe1d687e21e2ea5bde37e

SHA1
3c6f1a456979e71e4ee12b4a6640312cd0b3b511

SHA256
866a1e0c85f96dfe2518fedaa9cb13f76f83c6e5a87bc022f63f5cb29c844028

SHA512
8e59451e889e930b4f8b53e554cdd83de30f1b18680e015cf322d37f90a42e8ba97571cde974bd9ab9c0cc921da0f2e8c3bb31cfdce8b5ab7fe5f6fa07dbcb90

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe

Filesize
468KB

MD5
84ab490b73f09bd2b70cba386b7ef91e

SHA1
fd095bae1a606e6c4d1f43873ab15e3ab60ea3e0

SHA256
cc683cee8e3bc96ce65469b7a09df62f378d09d29ffc3e4f804c3646a52d46d6

SHA512
dea93aa7e3b0bb99b348322cf0928fa230607cca966e6553d1d89f685f684c2ccad70087dd27739cecf4f136e61854d9ecddfa44ef975fe420c5199b87087a82

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe

Filesize
468KB

MD5
dee87952d47c3601cff4d4552d0c1683

SHA1
49e732ce1ade36f67d02a881609b419602fd7ebe

SHA256
ace64d5a52d721aabb1eb277aaea65335b5ff670d390d84b26f3d9132f34568d

SHA512
0e32b370fd0d5a3b20f523c7a90bc7c3907c9e1f7cd94bc2fb2e0d55ff5150c52835d7af66bfa1dce9f8ce2a16e26e33d8e014d8a455da6030b7a82c3b1b65f0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65201.exe

Filesize
468KB

MD5
8a260031444733e84c2626e195b075bf

SHA1
1094ce6bfb21e55884189b9acd63df741943d641

SHA256
0b96a74e160da687026ed90f7e8f57a4fe98829bc63b0179293aefcbb149cbb3

SHA512
2cf229b06b67cd736a5a856d096cd85cc0028d710552cd87564c0808ffdf1b1428799bb7ed180136c4e5211ee809f55b2b423d7faade8b5e3da3965a93021800

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-921.exe

Filesize
468KB

MD5
a5feec973ea120b4f7053308b506cdd7

SHA1
d18a3a8b941a40df02f4b2aadf91c2dd2c969c98

SHA256
1575be8f68b93cdd560fdffc0e7b07dbb509a22de0b13ac19af4da5a527c45e2

SHA512
cb4beded6e100a5f69e12ac675ec2f8891e0d9e1a1afde11546fff660b167390f6b70016360a359b74993b9c789e6ae2d11493a5d89abcdce63a34e2db8ba797

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe

Filesize
468KB

MD5
219aac8bb2edc3d75d8542f74170de11

SHA1
68e89450ac299bfe81f11f0f05ba813f4b0455d5

SHA256
fe3c9b902e171a3da18c3a3c1fc187f1df7d287b91cb7862ef6c9f58b61bb079

SHA512
24390e3f1b97740e2f80f5cd50f873200545e0441ae712f31a3d1f07012ef9a49b823a049ba405bb5adec804a5b9477283b86326601d2aea24bef18295f53956

Download Submit