ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c

Analysis

max time kernel
148s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
Size

468KB
MD5

26148b1403cb52c05c11e84107d44bcc
SHA1

808781c78ef0b6aaa1b2b3570a40b2bc8dd2df7a
SHA256

ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c
SHA512

efc8a9fa674270a6bab7b73b0ad192a375c4bf41ff4c941c27b6103b41fc7f405858882c540c676a51246ed860a274a8b02ff0afd10edafb4876430759e7e338
SSDEEP

3072:phq7ogI5ID5EtbYRHzcicf8/KIwCpapHnLHewVUrQZ8L0aluMJlc:phWoctEtWH4icf+SqZQZ2rluM

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2960	Unicorn-41752.exe
2920	Unicorn-31528.exe
2956	Unicorn-43226.exe
2828	Unicorn-49780.exe
2420	Unicorn-60863.exe
2628	Unicorn-42489.exe
2652	Unicorn-47704.exe
2068	Unicorn-12250.exe
1888	Unicorn-58498.exe
2948	Unicorn-63947.exe
1416	Unicorn-61295.exe
572	Unicorn-15624.exe
2864	Unicorn-15624.exe
112	Unicorn-32079.exe
1680	Unicorn-26213.exe
1772	Unicorn-40834.exe
1656	Unicorn-64113.exe
2984	Unicorn-4518.exe
2216	Unicorn-37004.exe
784	Unicorn-45935.exe
1692	Unicorn-42405.exe
876	Unicorn-29599.exe
940	Unicorn-4637.exe
2236	Unicorn-37575.exe
2308	Unicorn-47781.exe
324	Unicorn-12878.exe
2340	Unicorn-8389.exe
1628	Unicorn-22124.exe
2476	Unicorn-28255.exe
1856	Unicorn-38281.exe
1664	Unicorn-59832.exe
2876	Unicorn-63361.exe
2892	Unicorn-64247.exe
2872	Unicorn-23289.exe
2624	Unicorn-28503.exe
268	Unicorn-3999.exe
2440	Unicorn-33795.exe
2500	Unicorn-39926.exe
2592	Unicorn-39540.exe
1900	Unicorn-1773.exe
1236	Unicorn-36484.exe
3048	Unicorn-42614.exe
2168	Unicorn-42614.exe
2788	Unicorn-55338.exe
2532	Unicorn-9401.exe
608	Unicorn-51275.exe
1216	Unicorn-9785.exe
2988	Unicorn-34747.exe
2780	Unicorn-10050.exe
2280	Unicorn-26512.exe
1592	Unicorn-12777.exe
2380	Unicorn-48979.exe
1924	Unicorn-49555.exe
2400	Unicorn-64361.exe
2132	Unicorn-57256.exe
2064	Unicorn-37390.exe
2008	Unicorn-21630.exe
2968	Unicorn-56763.exe
2712	Unicorn-53622.exe
2656	Unicorn-35248.exe
580	Unicorn-42959.exe
1412	Unicorn-19104.exe
296	Unicorn-19104.exe
2460	Unicorn-22590.exe

Loads dropped DLL 64 IoCs

pid	Process
2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
2960	Unicorn-41752.exe
2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
2960	Unicorn-41752.exe
2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
2920	Unicorn-31528.exe
2920	Unicorn-31528.exe
2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
2956	Unicorn-43226.exe
2956	Unicorn-43226.exe
2960	Unicorn-41752.exe
2960	Unicorn-41752.exe
2828	Unicorn-49780.exe
2828	Unicorn-49780.exe
2920	Unicorn-31528.exe
2920	Unicorn-31528.exe
2628	Unicorn-42489.exe
2628	Unicorn-42489.exe
2956	Unicorn-43226.exe
2956	Unicorn-43226.exe
2652	Unicorn-47704.exe
2652	Unicorn-47704.exe
2420	Unicorn-60863.exe
2420	Unicorn-60863.exe
2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
2960	Unicorn-41752.exe
2960	Unicorn-41752.exe
2068	Unicorn-12250.exe
2068	Unicorn-12250.exe
2828	Unicorn-49780.exe
2828	Unicorn-49780.exe
112	Unicorn-32079.exe
112	Unicorn-32079.exe
2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
2948	Unicorn-63947.exe
2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
2948	Unicorn-63947.exe
2628	Unicorn-42489.exe
1416	Unicorn-61295.exe
2960	Unicorn-41752.exe
2628	Unicorn-42489.exe
1416	Unicorn-61295.exe
2960	Unicorn-41752.exe
2956	Unicorn-43226.exe
2864	Unicorn-15624.exe
572	Unicorn-15624.exe
2956	Unicorn-43226.exe
572	Unicorn-15624.exe
2864	Unicorn-15624.exe
2420	Unicorn-60863.exe
2420	Unicorn-60863.exe
2920	Unicorn-31528.exe
1888	Unicorn-58498.exe
1888	Unicorn-58498.exe
2920	Unicorn-31528.exe
1772	Unicorn-40834.exe
1772	Unicorn-40834.exe
2068	Unicorn-12250.exe
2068	Unicorn-12250.exe
1656	Unicorn-64113.exe
1656	Unicorn-64113.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2120	800	WerFault.exe	105

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23522.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
2960	Unicorn-41752.exe
2920	Unicorn-31528.exe
2956	Unicorn-43226.exe
2828	Unicorn-49780.exe
2628	Unicorn-42489.exe
2420	Unicorn-60863.exe
2652	Unicorn-47704.exe
2068	Unicorn-12250.exe
1416	Unicorn-61295.exe
112	Unicorn-32079.exe
2948	Unicorn-63947.exe
1888	Unicorn-58498.exe
2864	Unicorn-15624.exe
572	Unicorn-15624.exe
1680	Unicorn-26213.exe
1772	Unicorn-40834.exe
1656	Unicorn-64113.exe
2984	Unicorn-4518.exe
2216	Unicorn-37004.exe
784	Unicorn-45935.exe
1692	Unicorn-42405.exe
876	Unicorn-29599.exe
940	Unicorn-4637.exe
2236	Unicorn-37575.exe
324	Unicorn-12878.exe
2308	Unicorn-47781.exe
2340	Unicorn-8389.exe
1628	Unicorn-22124.exe
1856	Unicorn-38281.exe
2876	Unicorn-63361.exe
1664	Unicorn-59832.exe
2892	Unicorn-64247.exe
2624	Unicorn-28503.exe
2872	Unicorn-23289.exe
268	Unicorn-3999.exe
2500	Unicorn-39926.exe
2440	Unicorn-33795.exe
2592	Unicorn-39540.exe
3048	Unicorn-42614.exe
1900	Unicorn-1773.exe
2168	Unicorn-42614.exe
1236	Unicorn-36484.exe
608	Unicorn-51275.exe
2532	Unicorn-9401.exe
2780	Unicorn-10050.exe
2988	Unicorn-34747.exe
1216	Unicorn-9785.exe
2788	Unicorn-55338.exe
2280	Unicorn-26512.exe
1592	Unicorn-12777.exe
2380	Unicorn-48979.exe
1924	Unicorn-49555.exe
2064	Unicorn-37390.exe
2132	Unicorn-57256.exe
2008	Unicorn-21630.exe
2400	Unicorn-64361.exe
2968	Unicorn-56763.exe
2712	Unicorn-53622.exe
2656	Unicorn-35248.exe
580	Unicorn-42959.exe
1412	Unicorn-19104.exe
296	Unicorn-19104.exe
2460	Unicorn-22590.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2960	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	30
PID 2348 wrote to memory of 2960	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	30
PID 2348 wrote to memory of 2960	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	30
PID 2348 wrote to memory of 2960	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	30
PID 2348 wrote to memory of 2920	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	32
PID 2348 wrote to memory of 2920	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	32
PID 2348 wrote to memory of 2920	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	32
PID 2348 wrote to memory of 2920	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	32
PID 2960 wrote to memory of 2956	2960	Unicorn-41752.exe	31
PID 2960 wrote to memory of 2956	2960	Unicorn-41752.exe	31
PID 2960 wrote to memory of 2956	2960	Unicorn-41752.exe	31
PID 2960 wrote to memory of 2956	2960	Unicorn-41752.exe	31
PID 2920 wrote to memory of 2828	2920	Unicorn-31528.exe	33
PID 2920 wrote to memory of 2828	2920	Unicorn-31528.exe	33
PID 2920 wrote to memory of 2828	2920	Unicorn-31528.exe	33
PID 2920 wrote to memory of 2828	2920	Unicorn-31528.exe	33
PID 2348 wrote to memory of 2420	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	34
PID 2348 wrote to memory of 2420	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	34
PID 2348 wrote to memory of 2420	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	34
PID 2348 wrote to memory of 2420	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	34
PID 2956 wrote to memory of 2628	2956	Unicorn-43226.exe	35
PID 2956 wrote to memory of 2628	2956	Unicorn-43226.exe	35
PID 2956 wrote to memory of 2628	2956	Unicorn-43226.exe	35
PID 2956 wrote to memory of 2628	2956	Unicorn-43226.exe	35
PID 2960 wrote to memory of 2652	2960	Unicorn-41752.exe	36
PID 2960 wrote to memory of 2652	2960	Unicorn-41752.exe	36
PID 2960 wrote to memory of 2652	2960	Unicorn-41752.exe	36
PID 2960 wrote to memory of 2652	2960	Unicorn-41752.exe	36
PID 2828 wrote to memory of 2068	2828	Unicorn-49780.exe	38
PID 2828 wrote to memory of 2068	2828	Unicorn-49780.exe	38
PID 2828 wrote to memory of 2068	2828	Unicorn-49780.exe	38
PID 2828 wrote to memory of 2068	2828	Unicorn-49780.exe	38
PID 2920 wrote to memory of 1888	2920	Unicorn-31528.exe	39
PID 2920 wrote to memory of 1888	2920	Unicorn-31528.exe	39
PID 2920 wrote to memory of 1888	2920	Unicorn-31528.exe	39
PID 2920 wrote to memory of 1888	2920	Unicorn-31528.exe	39
PID 2628 wrote to memory of 2948	2628	Unicorn-42489.exe	40
PID 2628 wrote to memory of 2948	2628	Unicorn-42489.exe	40
PID 2628 wrote to memory of 2948	2628	Unicorn-42489.exe	40
PID 2628 wrote to memory of 2948	2628	Unicorn-42489.exe	40
PID 2956 wrote to memory of 1416	2956	Unicorn-43226.exe	41
PID 2956 wrote to memory of 1416	2956	Unicorn-43226.exe	41
PID 2956 wrote to memory of 1416	2956	Unicorn-43226.exe	41
PID 2956 wrote to memory of 1416	2956	Unicorn-43226.exe	41
PID 2652 wrote to memory of 572	2652	Unicorn-47704.exe	42
PID 2652 wrote to memory of 572	2652	Unicorn-47704.exe	42
PID 2652 wrote to memory of 572	2652	Unicorn-47704.exe	42
PID 2652 wrote to memory of 572	2652	Unicorn-47704.exe	42
PID 2420 wrote to memory of 2864	2420	Unicorn-60863.exe	43
PID 2420 wrote to memory of 2864	2420	Unicorn-60863.exe	43
PID 2420 wrote to memory of 2864	2420	Unicorn-60863.exe	43
PID 2420 wrote to memory of 2864	2420	Unicorn-60863.exe	43
PID 2348 wrote to memory of 112	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	44
PID 2348 wrote to memory of 112	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	44
PID 2348 wrote to memory of 112	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	44
PID 2348 wrote to memory of 112	2348	ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe	44
PID 2960 wrote to memory of 1680	2960	Unicorn-41752.exe	45
PID 2960 wrote to memory of 1680	2960	Unicorn-41752.exe	45
PID 2960 wrote to memory of 1680	2960	Unicorn-41752.exe	45
PID 2960 wrote to memory of 1680	2960	Unicorn-41752.exe	45
PID 2068 wrote to memory of 1772	2068	Unicorn-12250.exe	46
PID 2068 wrote to memory of 1772	2068	Unicorn-12250.exe	46
PID 2068 wrote to memory of 1772	2068	Unicorn-12250.exe	46
PID 2068 wrote to memory of 1772	2068	Unicorn-12250.exe	46

C:\Users\Admin\AppData\Local\Temp\ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe
"C:\Users\Admin\AppData\Local\Temp\ed4ffd429bd92db20fe3b1e8d5eb7b02b0fa9b5617c88ec2cd7dde971472e50c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43226.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        8⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        8⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        8⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        8⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1693.exe
        7⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        7⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53502.exe
        7⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47931.exe
        7⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        7⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60195.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        6⤵
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42405.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34747.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        7⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        8⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
        8⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        8⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        8⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        7⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        7⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23881.exe
        7⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        6⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        6⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54402.exe
        6⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30303.exe
        7⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        7⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6866.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        6⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        5⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20434.exe
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52774.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46793.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        5⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14320.exe
        5⤵
        
        PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10050.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14054.exe
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64369.exe
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        8⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        8⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37183.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20446.exe
        7⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        6⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        6⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
        6⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-417.exe
        6⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12777.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        6⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe
        5⤵
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52415.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34922.exe
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
        5⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26556.exe
        6⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        7⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        7⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6358.exe
        6⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        6⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        6⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39938.exe
        5⤵
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        6⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        5⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7671.exe
        5⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62194.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        5⤵
        
        PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9785.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        5⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
        6⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49226.exe
        6⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
        5⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
        5⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        5⤵
        
        PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21899.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        5⤵
        
        PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31583.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10297.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
      4⤵
      PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
      4⤵
      PID:7396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47704.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-756.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54856.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57924.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
        6⤵
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51551.exe
        6⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
        5⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64369.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        6⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        6⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        5⤵
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10674.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        5⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        5⤵
        
        PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29109.exe
        5⤵
        
        PID:800
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 240
        6⤵
        Program crash
        
        PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        5⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe
        6⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        6⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        5⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
        5⤵
        
        PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
      4⤵
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21899.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38617.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
        5⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        5⤵
        
        PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58769.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
      4⤵
      PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      4⤵
      PID:6720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26213.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        5⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15419.exe
        6⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        6⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
        5⤵
        
        PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        5⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        5⤵
        
        PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
      4⤵
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64369.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19858.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        5⤵
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
      4⤵
      PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27605.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
      4⤵
      PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49555.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7209.exe
        5⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        6⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        5⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57924.exe
        5⤵
        
        PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exe
      4⤵
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50910.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        5⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
      4⤵
      PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24817.exe
      4⤵
      PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22890.exe
      4⤵
      PID:7184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64361.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
      4⤵
      PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
      4⤵
      PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
      4⤵
      PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
      4⤵
      PID:7620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
    3⤵
    PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exe
    3⤵
    PID:6216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64891.exe
    3⤵
    PID:7260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40834.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38281.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        8⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        7⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        7⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22590.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe
        8⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        8⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        8⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63709.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        8⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        7⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11342.exe
        8⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47846.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        7⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
        6⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-834.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        7⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        7⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37511.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        6⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11723.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24817.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59832.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        7⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        6⤵
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        6⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        6⤵
        
        PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53622.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33198.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        6⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        6⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        5⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1181.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34536.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62194.exe
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63361.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        7⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        8⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exe
        8⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        8⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37562.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29282.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        7⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        6⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19013.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56017.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47270.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
        6⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57703.exe
        6⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe
        5⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10188.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25030.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        6⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
        6⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        5⤵
        
        PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34922.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        5⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39893.exe
        6⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        6⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        6⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
        5⤵
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        5⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        5⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        5⤵
        
        PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        5⤵
        
        PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60123.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        5⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40218.exe
        5⤵
        
        PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44725.exe
      4⤵
      PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46793.exe
      4⤵
      PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      4⤵
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58498.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28255.exe
      4⤵
      Executes dropped EXE
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        5⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31917.exe
        6⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22190.exe
        6⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        6⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28391.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43666.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        5⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        5⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        6⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        6⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        6⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5206.exe
        5⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
        5⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
        5⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57703.exe
        5⤵
        
        PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39751.exe
      4⤵
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33960.exe
        5⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        5⤵
        
        PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37511.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
      4⤵
      PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22890.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        5⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
        6⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37183.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        5⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
        5⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        5⤵
        
        PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        5⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
      4⤵
      PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
      4⤵
      PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
      4⤵
      PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        5⤵
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        5⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        5⤵
        
        PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63717.exe
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
      4⤵
      PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
      4⤵
      PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe
      4⤵
      PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
      4⤵
      PID:7576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25025.exe
    3⤵
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
      4⤵
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
      4⤵
      PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
      4⤵
      PID:7940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
    3⤵
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25570.exe
    3⤵
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13562.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53315.exe
    3⤵
    PID:6832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
    3⤵
    PID:7308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37575.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        6⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        5⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
        5⤵
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        5⤵
        
        PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32814.exe
        5⤵
        
        PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        5⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        5⤵
        
        PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59419.exe
      4⤵
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44631.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
      4⤵
      PID:7500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        5⤵
        
        PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        5⤵
        
        PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
      4⤵
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
      4⤵
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        5⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        5⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17101.exe
        5⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
      4⤵
      PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
      4⤵
      PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
      4⤵
      PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43598.exe
      4⤵
      PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18455.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
      4⤵
      PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
      4⤵
      PID:6376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
    3⤵
    PID:352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
    3⤵
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
    3⤵
    PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36228.exe
    3⤵
    PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
    3⤵
    PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22890.exe
    3⤵
    PID:6540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4518.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
        5⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
        6⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        6⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43256.exe
        6⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31645.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
        5⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57703.exe
        5⤵
        
        PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
      4⤵
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
      4⤵
      PID:7976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4988.exe
      4⤵
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        5⤵
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52147.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        5⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11957.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16225.exe
      4⤵
      PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
      4⤵
      PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53502.exe
      4⤵
      PID:7732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6834.exe
    3⤵
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56229.exe
      4⤵
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
      4⤵
      PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
      4⤵
      PID:7228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
    3⤵
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
    3⤵
    PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
    3⤵
    PID:6516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
    3⤵
    PID:6304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
    3⤵
    PID:7840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
      4⤵
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        5⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2269.exe
      4⤵
      PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29202.exe
      4⤵
      PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
      4⤵
      PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55453.exe
      4⤵
      PID:7564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
    3⤵
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14542.exe
      4⤵
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
      4⤵
      PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3330.exe
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
      4⤵
      PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
      4⤵
      PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
    3⤵
    PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
    3⤵
    PID:6956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
    3⤵
    PID:6444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
    3⤵
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
      4⤵
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11114.exe
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
      4⤵
      PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
      4⤵
      PID:6400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
    3⤵
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
      4⤵
      PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10922.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
      4⤵
      PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
      4⤵
      PID:7280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
    3⤵
    PID:3264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exe
    3⤵
    PID:3680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
    3⤵
    PID:5680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6866.exe
    3⤵
    PID:5396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
    3⤵
    PID:6436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30989.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30989.exe
  2⤵
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
    3⤵
    PID:3208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
    3⤵
    PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
    3⤵
    PID:6496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
    3⤵
    PID:6620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
  2⤵
  PID:1948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48358.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48358.exe
  2⤵
  PID:3312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
  2⤵
  PID:4636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
  2⤵
  PID:6040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
  2⤵
  PID:6528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44385.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44385.exe
  2⤵
  PID:7532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe

Filesize
468KB

MD5
9a56205ffb524265bddb153d98d7c62e

SHA1
907a7275e59739f0c5045746a090b19aa3038324

SHA256
ddab19a6c2c619adb6b25de62a97d38787cd72881681c9b12b854d7d83a66ef2

SHA512
b536eb3b594f24c4994f08b9e223e1eca574c41e5894cf32f53458ee8913195b68fc283221059ea4ddbf19bf5d431d85f95394d93ee0a051d91381026f0126fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe

Filesize
468KB

MD5
520be729eb290796f3310571e7c2bfd5

SHA1
2612ca8b2a59afa8e03b9ea81f95d098a76dabc5

SHA256
7014d159d67998446336ef6c43e83e1f2d592a63f0d720e4e6308f1d9bd4995a

SHA512
55f6abc902dc435dbbff37345ee10d43528371bb1e52d00f93f0dcfd24783fc480cb61011980ceed3fab1017734f41a907e40d35937e5f68660a74279aba8b74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39938.exe

Filesize
468KB

MD5
86a6a9762f285e9f81cfa5025c8c3fba

SHA1
976a8999e5d121ad8fd799e003d05ac2b7250760

SHA256
c531b40548a864b89d26ac4e8931f0c0914fbbcb2052e0a9136a36ab2cccbd6c

SHA512
6ee093464a13ddccca99064feabfab1ec5c245cf2dd3595073f45ea82de13a391e5a2cc8059a8834038ad66d522bcde16799cd92ff13fba337b2a87ed7523369

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58498.exe

Filesize
468KB

MD5
2349d31e9f38e99a01099fc32d3c97ee

SHA1
2e06f4fe5fc8b11f880272e341607c155e1f94c7

SHA256
c0fa9580c0c9f0b3e912fea22a9192c2e11e21885f7a345343ba91d724838fca

SHA512
e6ea4c2574046004be07087a9fbbc1e502f44cfa8aac3f631632a59dfd1e18c1e2f254bda018288e9fe8caeb76ceb7080c1fef9efcf7a4c1d96925848335b737

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe

Filesize
468KB

MD5
e35a92bf467eaa878f613a802a431e72

SHA1
a9cf90c2d87753a472381677c0a5deedca191cfe

SHA256
7f5fec55266ece36f34b649d386f7b50e20a71782393afd1db071be71470732c

SHA512
282829509e41effc5639328dd7884b7269419f8de47bf2a547af17c952348622bfb48f7efd32c0cb296cd774509c98e956d4541ba1b2b796538713beaea6a49e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26213.exe

Filesize
468KB

MD5
12a9d9e6f22c0493b6eb43f61915a4d9

SHA1
591ce3fd072866b991902d93a89993c8e96926ea

SHA256
022fd8c8bf32b2cd534b8ecbfa60d47438b4c494fffe0c1c2e1a845442c2397c

SHA512
956605f84736f455b72d97d3aeb78118a3b892692bd0a9a575cb8e17180376f8739af54a78bd7e6f5ab9d6dc590e328244f6031595eac6601f75f20b8c3d2e02

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe

Filesize
468KB

MD5
197149e7d795c388636894f7fb79663f

SHA1
fb7cafb3365f6a5b5c7ed38b0c45d445db19aeb7

SHA256
e32fde698e3f820723e63e79ced087e5e3bd83a8ec9fe2f22c4edad9d8d92b39

SHA512
8bc6594dd2532cd9fb4a62d92a833c533c195cd445b78f5ca94a8c5e8c72b67bf02ff9877640bfc7c10099d085c176d57dff4dfbae149b7b73b3ef427c93f334

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40834.exe

Filesize
468KB

MD5
2e0194d9a06f23bd671bad6df2c6f553

SHA1
5d174a7cc4e2f6dfebaf9a3d7b6ffd3dea72bcbe

SHA256
2cec33bc257c039a272b276ce676bf923f78ac045f60e3b2097f631c501772ef

SHA512
b99b58729b14ebad787042d946fa829ae2e86fd46e13f01f7bb947b50932abb16665f41e1ab33119a5ed92e68bf5c109775a6521e37ae84008dec12c2e2a8fd0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe

Filesize
468KB

MD5
e12bc9d1f3f99deffc28dccdc8ca8eed

SHA1
72a7e1fe9147062a5fa4d0743329cf29461606f4

SHA256
f5aaeff44ce3da59d0cb1e22f57b79db7ec826fe93a0d4898e33e7cc9bb0c6e0

SHA512
0dff1e4b1bce82b1071455cf07eba4a8f6dbe1f4b7850aa8e67976b3e529cc11b17506552b36f6de0e631d1715ce4a7436c910befd663bcef2b572a0e7511446

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe

Filesize
468KB

MD5
0e60edf3e01b59202aa8aa75f9750e3b

SHA1
8207ae09797235a3106cfa54152f845cf4cb7939

SHA256
2d574424ddccffd82e0fa65c4f8b2df3c5a14cc50e41df0b9ec43eeb6da2fba6

SHA512
36ddfd0b09e2a9afcad2f83b14630ed55408a6a6241197b98c5939b9c2227239ea7e264a0842d5f36850638ad63cfd1ff2373c4da0bf6638ab61a4123685101a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43226.exe

Filesize
468KB

MD5
f59cc7fe582811033b96d7460744311d

SHA1
6ced6ef129afb4a6bf5030edd33fd31cf799b60e

SHA256
1d3a22a46afdc7c3319aa17f5bc9045b1e70d4f8c13d8fbd690ab843552422f1

SHA512
febbbb401837b8f53d48b8941c95e3b9d42a8498938835c3c86d1e317bdf0aafd55976310d1b3f59373a0a34343cf4f4cb6011fc26d679133411de0ca940f368

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4518.exe

Filesize
468KB

MD5
993a6cdbad9f16ef010b91ba59e98ffd

SHA1
6ffaab89c9359d4b0bd4847f2ecff9b095dbab0b

SHA256
660e66da40c3478a32007fe7fd1696b1039be7c9b56dbfd8ce57bd90f5caab53

SHA512
56175649bbbdad805d232c548dab2bdc94516929158eaf02e275456c126940c83a3cccf85ea908375454da19ea722fa5841e766eb045ad4265b968dce4b67b92

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47704.exe

Filesize
468KB

MD5
d3ffd3335ebcd73dad68c86b8fe5e5d4

SHA1
694354f8cf70e4b34926f0a799d6c3756fcf21b9

SHA256
8ece7495553e614e4cec04b340ca9fa5d9257e9e1b9318162020b53abd5e5999

SHA512
f1078e60a061a9525a2f542a2e723a5ea07ae2eb0c8f1aca8f6b488464b3f78795639b71a87a04744fd3ede8c247a69fc81b29e1d319aefee0c6264f38bf0245

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe

Filesize
468KB

MD5
9fb534f0972d46dfcc59cabb05a101db

SHA1
b482b3de7637f414494f2556097a4d1b0088d372

SHA256
d19150dae2ca80fa76d947dd47250007b85da57bf831e19ed57c076f31dbc005

SHA512
16a1ebe1141b02caf5dff036655f9517c894bde94b983038393c612e750bb62e504056bbda40603d1a414b508370a8205eb70520f4f138a6eae01b33a56ab167

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe

Filesize
468KB

MD5
4265c5e7e3ede4abf936a4f802170fc9

SHA1
ef0323f948a97b7e59fe9f080ff79ecdbdd4f45e

SHA256
e6d515369226172689c0b8646e0183da98f29a7e587ca41f4767e7e86b426423

SHA512
d085b26149abe1b05973b606103c851ab6c3732e45b4deb60a58b7c3a4df77a0d35a09bdcc01b6afd6b012116a8aaf746e076d3efd29183b18b55643f3c53a7c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe

Filesize
468KB

MD5
70d33b52288f2a19ec1abd07b3279fa0

SHA1
0c065265328ab0d442349f2f4d474d89a9e442f8

SHA256
d93d8493efc30c53c79cd9437b2faf0436e3088e1b2cd32fb83cc6a37fbf99d9

SHA512
0311b4922d2daf702f5220ebb82b7a7962381682823194d91def783c2754ca95021265cd3fcd0954fc3713caddb3309194bc2161d4d91b5912d47ccc43e697aa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe

Filesize
468KB

MD5
b7c5a3e4cf073af568daa108aee8a71a

SHA1
f558b3fc4a99878f6c7ef285f3df0c27e9897f5a

SHA256
a0b8d779541c87dd8c02bb08e1aa082e343676789354af71394579ae3ae42965

SHA512
ff5add75d57eaf1af8aa3d878229c453e23a201f8aab53cfed2570f3d5c6ff2159f973c5324c77a92a73396af1794518feb9a620611b0008c70c83f3b9d227be

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe

Filesize
468KB

MD5
99d47e7c0d361bb8a4c8272f2a8c87a0

SHA1
bf44141d48c60abc9cd22347fe8465a2ccdba375

SHA256
de12fabf37aafc974f97454cfca8e5e324709d90b26ed670ede750f6ef6a4a74

SHA512
4a9b34157575ec0fb861fde8237646515b8814f91d3faf9aec44482059bfd34bd4eec7d36ca016171796f41f5be27d1fdfd79f6f9aad510ee6a37ada44cb5d49

Download Submit
memory/112-216-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/112-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/112-394-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/112-215-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/268-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/324-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/572-288-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/572-273-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/572-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/784-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/876-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1416-263-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1416-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1416-260-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1628-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-354-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/1656-353-0x0000000001D60000-0x0000000001DD5000-memory.dmp

Filesize
468KB

Download
memory/1664-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-385-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1680-384-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1680-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-336-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/1772-332-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/1856-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1888-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1888-313-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1888-310-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2068-190-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2068-185-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2068-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2068-345-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2216-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-225-0x0000000000690000-0x0000000000705000-memory.dmp

Filesize
468KB

Download
memory/2348-236-0x0000000000690000-0x0000000000705000-memory.dmp

Filesize
468KB

Download
memory/2348-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-159-0x0000000000690000-0x0000000000705000-memory.dmp

Filesize
468KB

Download
memory/2348-160-0x0000000000690000-0x0000000000705000-memory.dmp

Filesize
468KB

Download
memory/2348-33-0x0000000000690000-0x0000000000705000-memory.dmp

Filesize
468KB

Download
memory/2348-13-0x0000000000690000-0x0000000000705000-memory.dmp

Filesize
468KB

Download
memory/2348-11-0x0000000000690000-0x0000000000705000-memory.dmp

Filesize
468KB

Download
memory/2348-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-306-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2420-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-140-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2420-297-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2420-144-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2440-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-262-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2628-246-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2628-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-405-0x0000000001C80000-0x0000000001CF5000-memory.dmp

Filesize
468KB

Download
memory/2652-133-0x0000000001C80000-0x0000000001CF5000-memory.dmp

Filesize
468KB

Download
memory/2652-138-0x0000000001C80000-0x0000000001CF5000-memory.dmp

Filesize
468KB

Download
memory/2828-202-0x0000000003340000-0x00000000033B5000-memory.dmp

Filesize
468KB

Download
memory/2828-203-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/2828-361-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/2864-289-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2864-271-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2872-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-312-0x00000000027F0000-0x0000000002865000-memory.dmp

Filesize
468KB

Download
memory/2920-417-0x00000000029F0000-0x0000000002A65000-memory.dmp

Filesize
468KB

Download
memory/2920-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-43-0x00000000029F0000-0x0000000002A65000-memory.dmp

Filesize
468KB

Download
memory/2920-311-0x00000000027F0000-0x0000000002865000-memory.dmp

Filesize
468KB

Download
memory/2948-235-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2948-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-238-0x00000000024B0000-0x0000000002525000-memory.dmp

Filesize
468KB

Download
memory/2956-70-0x0000000001F50000-0x0000000001FC5000-memory.dmp

Filesize
468KB

Download
memory/2956-287-0x0000000001F50000-0x0000000001FC5000-memory.dmp

Filesize
468KB

Download
memory/2956-129-0x0000000001F50000-0x0000000001FC5000-memory.dmp

Filesize
468KB

Download
memory/2956-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-23-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2960-393-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2960-77-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2960-266-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2960-261-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2960-169-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2960-168-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2960-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-376-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2984-375-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2984-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download