f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe
Size

468KB
MD5

0a03c05a513c4b84579c21e672cc87ab
SHA1

2aecc05afbbf60520031bab3f39c126af4f6c1d0
SHA256

f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299
SHA512

15db58f443764381c6ae204cedeefd9ed81e77535d839b2f7fdb16c1de0eccc178a5a23df0b14169a81b856a3f42b7f525fef3071c4415a4c1d99d0fe7cbbb25
SSDEEP

3072:tIUgogg4jKQU2bYLUzlFYp8g1Cik7wpD5mHB0VpR0Wr3lP0S0rmM:tIrouvU20URFYpEMQA0WzJ0S0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2384	Unicorn-37727.exe
536	Unicorn-10516.exe
2360	Unicorn-35767.exe
2900	Unicorn-28280.exe
2812	Unicorn-57231.exe
2912	Unicorn-48508.exe
2896	Unicorn-9321.exe
2748	Unicorn-29323.exe
2116	Unicorn-41937.exe
3016	Unicorn-29178.exe
1032	Unicorn-33816.exe
1208	Unicorn-18387.exe
1484	Unicorn-24518.exe
1924	Unicorn-24518.exe
1984	Unicorn-7916.exe
1380	Unicorn-2187.exe
432	Unicorn-22053.exe
1980	Unicorn-60847.exe
992	Unicorn-42473.exe
1412	Unicorn-36011.exe
2860	Unicorn-55877.exe
2640	Unicorn-39541.exe
1648	Unicorn-22136.exe
1540	Unicorn-49747.exe
2480	Unicorn-23458.exe
944	Unicorn-1834.exe
1592	Unicorn-26966.exe
2580	Unicorn-37901.exe
1756	Unicorn-46832.exe
2304	Unicorn-46832.exe
516	Unicorn-18135.exe
2804	Unicorn-904.exe
2232	Unicorn-64943.exe
2852	Unicorn-25233.exe
2688	Unicorn-20595.exe
2660	Unicorn-61518.exe
1960	Unicorn-61518.exe
2736	Unicorn-32281.exe
1456	Unicorn-29016.exe
2332	Unicorn-16572.exe
2020	Unicorn-20988.exe
2776	Unicorn-38144.exe
1180	Unicorn-38144.exe
2052	Unicorn-37398.exe
2132	Unicorn-25700.exe
1784	Unicorn-340.exe
1512	Unicorn-8051.exe
1732	Unicorn-29889.exe
1184	Unicorn-10023.exe
2548	Unicorn-26058.exe
2172	Unicorn-4699.exe
2508	Unicorn-38524.exe
2320	Unicorn-38524.exe
2572	Unicorn-38524.exe
2456	Unicorn-16057.exe
2084	Unicorn-60790.exe
2068	Unicorn-3613.exe
2872	Unicorn-10106.exe
2704	Unicorn-13635.exe
1532	Unicorn-56147.exe
2980	Unicorn-21467.exe
1656	Unicorn-48201.exe
2996	Unicorn-14642.exe
1312	Unicorn-23557.exe

Loads dropped DLL 64 IoCs

pid	Process
2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe
2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe
2384	Unicorn-37727.exe
2384	Unicorn-37727.exe
2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe
2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe
536	Unicorn-10516.exe
536	Unicorn-10516.exe
2384	Unicorn-37727.exe
2384	Unicorn-37727.exe
2360	Unicorn-35767.exe
2360	Unicorn-35767.exe
2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe
2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe
2900	Unicorn-28280.exe
2900	Unicorn-28280.exe
536	Unicorn-10516.exe
536	Unicorn-10516.exe
2912	Unicorn-48508.exe
2912	Unicorn-48508.exe
2360	Unicorn-35767.exe
2360	Unicorn-35767.exe
2384	Unicorn-37727.exe
2384	Unicorn-37727.exe
2896	Unicorn-9321.exe
2812	Unicorn-57231.exe
2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe
2896	Unicorn-9321.exe
2812	Unicorn-57231.exe
2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2900	Unicorn-28280.exe
2900	Unicorn-28280.exe
2116	Unicorn-41937.exe
536	Unicorn-10516.exe
536	Unicorn-10516.exe
2116	Unicorn-41937.exe
3016	Unicorn-29178.exe
3016	Unicorn-29178.exe
2912	Unicorn-48508.exe
2912	Unicorn-48508.exe
1032	Unicorn-33816.exe
1032	Unicorn-33816.exe
2360	Unicorn-35767.exe
1208	Unicorn-18387.exe
1484	Unicorn-24518.exe
2360	Unicorn-35767.exe
1208	Unicorn-18387.exe
1484	Unicorn-24518.exe
2812	Unicorn-57231.exe
2812	Unicorn-57231.exe
2384	Unicorn-37727.exe
2384	Unicorn-37727.exe
2896	Unicorn-9321.exe
2896	Unicorn-9321.exe
2268	WerFault.exe
2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2268	2748	WerFault.exe	38
2288	3028	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64542.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe
2384	Unicorn-37727.exe
536	Unicorn-10516.exe
2360	Unicorn-35767.exe
2900	Unicorn-28280.exe
2912	Unicorn-48508.exe
2896	Unicorn-9321.exe
2812	Unicorn-57231.exe
2748	Unicorn-29323.exe
2116	Unicorn-41937.exe
3016	Unicorn-29178.exe
1032	Unicorn-33816.exe
1484	Unicorn-24518.exe
1208	Unicorn-18387.exe
1924	Unicorn-24518.exe
1984	Unicorn-7916.exe
1380	Unicorn-2187.exe
1980	Unicorn-60847.exe
432	Unicorn-22053.exe
992	Unicorn-42473.exe
1540	Unicorn-49747.exe
2860	Unicorn-55877.exe
2640	Unicorn-39541.exe
1648	Unicorn-22136.exe
1412	Unicorn-36011.exe
2480	Unicorn-23458.exe
2580	Unicorn-37901.exe
1756	Unicorn-46832.exe
1592	Unicorn-26966.exe
944	Unicorn-1834.exe
2304	Unicorn-46832.exe
516	Unicorn-18135.exe
2804	Unicorn-904.exe
2232	Unicorn-64943.exe
2688	Unicorn-20595.exe
2852	Unicorn-25233.exe
2332	Unicorn-16572.exe
2020	Unicorn-20988.exe
2736	Unicorn-32281.exe
1960	Unicorn-61518.exe
2660	Unicorn-61518.exe
2776	Unicorn-38144.exe
1456	Unicorn-29016.exe
1180	Unicorn-38144.exe
2132	Unicorn-25700.exe
2052	Unicorn-37398.exe
1784	Unicorn-340.exe
1512	Unicorn-8051.exe
1184	Unicorn-10023.exe
1732	Unicorn-29889.exe
2548	Unicorn-26058.exe
2508	Unicorn-38524.exe
2172	Unicorn-4699.exe
2704	Unicorn-13635.exe
2572	Unicorn-38524.exe
2320	Unicorn-38524.exe
2456	Unicorn-16057.exe
2084	Unicorn-60790.exe
2068	Unicorn-3613.exe
2872	Unicorn-10106.exe
1532	Unicorn-56147.exe
2996	Unicorn-14642.exe
2980	Unicorn-21467.exe
1312	Unicorn-23557.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2384	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	30
PID 2200 wrote to memory of 2384	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	30
PID 2200 wrote to memory of 2384	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	30
PID 2200 wrote to memory of 2384	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	30
PID 2384 wrote to memory of 536	2384	Unicorn-37727.exe	32
PID 2384 wrote to memory of 536	2384	Unicorn-37727.exe	32
PID 2384 wrote to memory of 536	2384	Unicorn-37727.exe	32
PID 2384 wrote to memory of 536	2384	Unicorn-37727.exe	32
PID 2200 wrote to memory of 2360	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	33
PID 2200 wrote to memory of 2360	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	33
PID 2200 wrote to memory of 2360	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	33
PID 2200 wrote to memory of 2360	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	33
PID 536 wrote to memory of 2900	536	Unicorn-10516.exe	34
PID 536 wrote to memory of 2900	536	Unicorn-10516.exe	34
PID 536 wrote to memory of 2900	536	Unicorn-10516.exe	34
PID 536 wrote to memory of 2900	536	Unicorn-10516.exe	34
PID 2384 wrote to memory of 2812	2384	Unicorn-37727.exe	35
PID 2384 wrote to memory of 2812	2384	Unicorn-37727.exe	35
PID 2384 wrote to memory of 2812	2384	Unicorn-37727.exe	35
PID 2384 wrote to memory of 2812	2384	Unicorn-37727.exe	35
PID 2360 wrote to memory of 2912	2360	Unicorn-35767.exe	36
PID 2360 wrote to memory of 2912	2360	Unicorn-35767.exe	36
PID 2360 wrote to memory of 2912	2360	Unicorn-35767.exe	36
PID 2360 wrote to memory of 2912	2360	Unicorn-35767.exe	36
PID 2200 wrote to memory of 2896	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	37
PID 2200 wrote to memory of 2896	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	37
PID 2200 wrote to memory of 2896	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	37
PID 2200 wrote to memory of 2896	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	37
PID 2900 wrote to memory of 2748	2900	Unicorn-28280.exe	38
PID 2900 wrote to memory of 2748	2900	Unicorn-28280.exe	38
PID 2900 wrote to memory of 2748	2900	Unicorn-28280.exe	38
PID 2900 wrote to memory of 2748	2900	Unicorn-28280.exe	38
PID 536 wrote to memory of 2116	536	Unicorn-10516.exe	39
PID 536 wrote to memory of 2116	536	Unicorn-10516.exe	39
PID 536 wrote to memory of 2116	536	Unicorn-10516.exe	39
PID 536 wrote to memory of 2116	536	Unicorn-10516.exe	39
PID 2912 wrote to memory of 3016	2912	Unicorn-48508.exe	40
PID 2912 wrote to memory of 3016	2912	Unicorn-48508.exe	40
PID 2912 wrote to memory of 3016	2912	Unicorn-48508.exe	40
PID 2912 wrote to memory of 3016	2912	Unicorn-48508.exe	40
PID 2360 wrote to memory of 1032	2360	Unicorn-35767.exe	41
PID 2360 wrote to memory of 1032	2360	Unicorn-35767.exe	41
PID 2360 wrote to memory of 1032	2360	Unicorn-35767.exe	41
PID 2360 wrote to memory of 1032	2360	Unicorn-35767.exe	41
PID 2384 wrote to memory of 1208	2384	Unicorn-37727.exe	42
PID 2384 wrote to memory of 1208	2384	Unicorn-37727.exe	42
PID 2384 wrote to memory of 1208	2384	Unicorn-37727.exe	42
PID 2384 wrote to memory of 1208	2384	Unicorn-37727.exe	42
PID 2896 wrote to memory of 1924	2896	Unicorn-9321.exe	43
PID 2896 wrote to memory of 1924	2896	Unicorn-9321.exe	43
PID 2896 wrote to memory of 1924	2896	Unicorn-9321.exe	43
PID 2896 wrote to memory of 1924	2896	Unicorn-9321.exe	43
PID 2812 wrote to memory of 1484	2812	Unicorn-57231.exe	44
PID 2812 wrote to memory of 1484	2812	Unicorn-57231.exe	44
PID 2812 wrote to memory of 1484	2812	Unicorn-57231.exe	44
PID 2812 wrote to memory of 1484	2812	Unicorn-57231.exe	44
PID 2200 wrote to memory of 1984	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	45
PID 2200 wrote to memory of 1984	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	45
PID 2200 wrote to memory of 1984	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	45
PID 2200 wrote to memory of 1984	2200	f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe	45
PID 2748 wrote to memory of 2268	2748	Unicorn-29323.exe	46
PID 2748 wrote to memory of 2268	2748	Unicorn-29323.exe	46
PID 2748 wrote to memory of 2268	2748	Unicorn-29323.exe	46
PID 2748 wrote to memory of 2268	2748	Unicorn-29323.exe	46

C:\Users\Admin\AppData\Local\Temp\f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe
"C:\Users\Admin\AppData\Local\Temp\f572a9335a5d343f137979547a7a0807eb0e4d30df27bedb708237d6e9444299.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37727.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37727.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28280.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 240
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        8⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        8⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        8⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34528.exe
        8⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        8⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10357.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34656.exe
        7⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37842.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        7⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52738.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
        6⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16454.exe
        7⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        8⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
        8⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
        8⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41118.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57172.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        7⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44570.exe
        7⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21284.exe
        6⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50171.exe
        7⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15877.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        6⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18208.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        6⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        6⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32617.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
        6⤵
        
        PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        5⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64542.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37842.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39309.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41937.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22053.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40896.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        8⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40930.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3934.exe
        8⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
        8⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5161.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        7⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
        7⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10106.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
        7⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57125.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        7⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24599.exe
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48861.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24307.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        6⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        7⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32242.exe
        7⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38794.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        5⤵
        
        PID:3028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 220
        6⤵
        Program crash
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        5⤵
        
        PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
        5⤵
        
        PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        6⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33522.exe
        7⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        7⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57231.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
        6⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52914.exe
        5⤵
        
        PID:272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
        6⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23951.exe
        7⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        8⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44884.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20108.exe
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26005.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        7⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27818.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9594.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38754.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15179.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27637.exe
        5⤵
        
        PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9575.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
      4⤵
      PID:968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3972.exe
      4⤵
      PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6656.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39193.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
      4⤵
      PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57231.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38144.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3143.exe
        8⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        8⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2792.exe
        8⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19992.exe
        7⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        6⤵
        Executes dropped EXE
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2343.exe
        6⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        6⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        6⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25233.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        7⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22915.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53327.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
        7⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8264.exe
        6⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33358.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8154.exe
        6⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8019.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37090.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58147.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
        5⤵
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57474.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56836.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50171.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62668.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53177.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60790.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
        5⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4914.exe
        5⤵
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
      4⤵
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63740.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
      4⤵
      PID:5364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61518.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14642.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50216.exe
        7⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57231.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        8⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46065.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52217.exe
        8⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49733.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34710.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
        7⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        6⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46332.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50408.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        6⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52759.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40950.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        7⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60551.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6987.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
        5⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54278.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47161.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23530.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38144.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
        5⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30402.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        6⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20622.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52326.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45928.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
      4⤵
      PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe
      4⤵
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
      4⤵
      PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43999.exe
      4⤵
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56078.exe
        5⤵
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20951.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
      4⤵
      PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
      4⤵
      PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13906.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
      4⤵
      PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
    3⤵
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
      4⤵
      PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
      4⤵
      PID:524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36322.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36940.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29493.exe
    3⤵
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49914.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
    3⤵
    PID:4244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
    3⤵
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
    3⤵
    PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
    3⤵
    PID:6428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48508.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13635.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
        7⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52326.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40924.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        6⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe
        6⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
        6⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22915.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        6⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5279.exe
        5⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        6⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3411.exe
        6⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        5⤵
        
        PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        5⤵
        
        PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44528.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38856.exe
        5⤵
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36011.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        6⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57125.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        5⤵
        
        PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24397.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exe
        5⤵
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39427.exe
      4⤵
      PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
      4⤵
      PID:3012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33816.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61518.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        6⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        6⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        5⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23307.exe
        5⤵
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39806.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        6⤵
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43661.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55202.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49308.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
        5⤵
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40491.exe
      4⤵
      PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42795.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24352.exe
      4⤵
      PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10023.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34041.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
      4⤵
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29173.exe
      4⤵
      PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46647.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11121.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37471.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11457.exe
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
      4⤵
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51487.exe
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe
      4⤵
      PID:6352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63849.exe
    3⤵
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15290.exe
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
    3⤵
    PID:4064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33324.exe
    3⤵
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21505.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56237.exe
    3⤵
    PID:5216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37398.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55234.exe
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28175.exe
        6⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        5⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46332.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        5⤵
        
        PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25700.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exe
        5⤵
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        5⤵
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36322.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2601.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        5⤵
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
      4⤵
      PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38043.exe
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39235.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
      4⤵
      PID:6460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18535.exe
      4⤵
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24844.exe
      4⤵
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57231.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exe
      4⤵
      PID:288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
      4⤵
      PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
    3⤵
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36670.exe
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56836.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12585.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34795.exe
      4⤵
      PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19125.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5908.exe
    3⤵
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22660.exe
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
    3⤵
    PID:4716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23207.exe
    3⤵
    PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49387.exe
    3⤵
    PID:5512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
      4⤵
      PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61549.exe
    3⤵
    PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
    3⤵
    PID:108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14249.exe
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
    3⤵
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
    3⤵
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
    3⤵
    PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
    3⤵
    PID:5692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37901.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37901.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
    3⤵
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8019.exe
      4⤵
      PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
      4⤵
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
      4⤵
      PID:6612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
    3⤵
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exe
    3⤵
    PID:3964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
    3⤵
    PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53091.exe
    3⤵
    PID:5436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
  2⤵
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
    3⤵
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45061.exe
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26020.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
    3⤵
    PID:5184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
  2⤵
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37514.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37514.exe
  2⤵
  PID:4016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
  2⤵
  PID:3792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
  2⤵
  PID:5760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
  2⤵
  PID:5408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe

Filesize
468KB

MD5
0487a8f1f5c8bc0189e1ce5fc8766096

SHA1
de2ab3d2f373d4b60c669227d98685b86f3efccc

SHA256
7ac9c713550b8fed5646d6b2d6406a3ab30bd5734cb1c2406a1a99bc4720fcc4

SHA512
73243476f5f4f070e1fe5e86b8edf57ada90a2ee6c9536c68518899ce8df50e380cc95f31e62d2a73151780c50c5c93e13e5a79ef4578cea8afb84b4318eb4a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe

Filesize
468KB

MD5
1c555aea4b0c145b1c9fcc75da0b2153

SHA1
8849e4675edbe67a20c00e3e1d9e8061411e828e

SHA256
c7a37f11b11a35ebdcb752ceedb51b0943d554d5ea225c942c8e2c9607cb632b

SHA512
cd5e6ef59f317204a7174a02db2f372a153d978a93f4581c9e16f71b43a49811f654db459eb116f46357d41a489b350329f8b62d11ba3b4ce5b9d7c1e541e611

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23307.exe

Filesize
468KB

MD5
8dc7d7fa68157aedb87382f5cb46840e

SHA1
b2db335b479e03d21be1237e911e6b4797f07367

SHA256
230b73090c7a49114a28e887cec54d9fa1eebefba8390f917fd7e399e58e6020

SHA512
6dfac8c1dde5d8a4f89314793db2558e002ad79828fb482b207d6d3bbbebd1d05eb8216196f7ebea8c5ed32e0f5a74b3645d94214ff25b23ae9010b74aef32eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe

Filesize
468KB

MD5
070513788fd6d8fbaebf61a96ba536b1

SHA1
2b09796ea840e7b74d3b27ad694987403b7d8ac3

SHA256
3695814bea75515cf2cc1e36ea8a9bd724a035c6128651b072653221c437c793

SHA512
2a5c19864bbd5528ff7452b0948ebd0ea4ae1144bbedfb0936b9b57d62a8a981a1bec65f40bfe31d0f0ca13de95e5b11f71bec529041aeea75c6027bd835ba0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe

Filesize
468KB

MD5
fbb5ceedaee72d5ec57c326b8b011688

SHA1
65e895450d820fbf1ea34b207d5d3b39e9a75fff

SHA256
485be2537c96c5f0b30e9b590f0ee0ab0f532724e785c64c8790ada3fdcab9b4

SHA512
2f5877e09b35fbfa908ddb7201b5b9e083d59e693f8cf96548026dbf792b19b46b9d4337cf76fdfcc5484b7602955df73d14b0ff9b88d3ab93959235523fa74e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48508.exe

Filesize
468KB

MD5
80842c553266b9ac9f662a0354ad2396

SHA1
9018076a6991470cbf464c0a6ee57eeb851ec189

SHA256
a82d11e87cd0ed2d009d13533b386e52e276532b20e0ab5f13bba2b654e1ad8e

SHA512
4d4af3576558688b4f6f52fd88f197aacb271755b6ae298efff463d320181ee4068006af90e757f90fa6ce063b11f1b599b3409becb42b127edf9b8056ddabda

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe

Filesize
468KB

MD5
39c22c314f1a2dd93ed270ae9f98865e

SHA1
ae0be8475ce8a16b997f61b38f4d269600872e83

SHA256
0a8b0fdfe3a32de73294415abce97ceb5b09df5dacabd9aecdf9f2804563c1a8

SHA512
8bf50a95ca4bc87c7e7140240d189973b4803afa487e8f31066810377b9bab1d43e4c44d015dfb2a677e9bedc050e6adde1f261d95b20539aeceb3bb41d0bcbd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe

Filesize
468KB

MD5
460428eb593bb11fc0428c2c3fded36b

SHA1
306a6e6ad703f5f87d198047c844c690e7f3fa20

SHA256
407903f0676fabbedc21a6fe123b22f0c463bbb5901f32363a179f548418010b

SHA512
03c1a28f0a9c3c09fcfd1ea02f06cb51866e95a1776db6cdaa052660bb07fd5788d36a221de5a21d479a344f8a69c489d340316499563d31476123e5c9f86359

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe

Filesize
468KB

MD5
5675f29ea13cb61b52e8ebaa00a91b2d

SHA1
f0a77eb3652c83e3d3a65e94a9228581e0563da1

SHA256
c1ad15b5cc51b9b54ca159941c05a35b4450915258ea18b16d2f320826054dd1

SHA512
417ccc8fbdd1cd4cae05e3e088f36e0d5b176a0bd290a16e8c9ce4a7b7253f0736bb4f0669353553db08908230a020fabf5794818d1057b539859697e719f3d0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28280.exe

Filesize
468KB

MD5
f0cdc77f4e6c4efb46457c91d3bf62a4

SHA1
cc0c0106de5af4b779f136df866861280eb3bc16

SHA256
7148b67b04f405d1c1dcbc4cbb37dc4e6b343b07eb46735c525cda5a25e2c41b

SHA512
77f2450b930a970b00ad2cb8a86d8e4e37f73ca0ee0de09479471e10ab8484f4e09ce3bf427ccab7e136d4ff4665f0e75b740926262205fb922aaf5d7fd7543c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe

Filesize
468KB

MD5
43f4df391df9b634d1dab402cfdcaa78

SHA1
0c442f40b74de9ede3b279b46e0400d9a1e51c3f

SHA256
29a275bac3f066e48601f77b4a39c517b22ee3fb36a4818e1f250dbaa47e4518

SHA512
ab3d3b6d65e984961fb33c4d64563b476b2732550f6896bbdfccd2f29bfb0a5cce811e54633fa3fd17a53147bc82f2b2ccb538ec133add11e02a0ed4e78c4668

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33816.exe

Filesize
468KB

MD5
aab0cf71079efbe21c49cc14594f6d8b

SHA1
d33bca4f0f3d02ddced47080f8bf7d611fa81dc0

SHA256
99f3e500c9b4ede58cf2663f5dab280d71ae0035f84bbb911183c09d819eb7fc

SHA512
588259b433b5280fc1761e4c5d8e5635db8d1b90da83a526eef73c749a6dbad88e3f79485af015b34751a523ec67b776bb0ab8127af45d15b0c14a5aa8cea758

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe

Filesize
468KB

MD5
acefc86d48c7b3ad7b63c9a689cf8cea

SHA1
8510f1bf780970827b53b195d01e1f7f6a356bb8

SHA256
edd777ed030a1921c23e839359e7bb41cdfc31f6985d9a29337acb1fb4c99506

SHA512
d749edf82426f38a972bcd15ca99ec6e038d0e3e43bbce3820078e676b7e25f1e169795c1c6c35a0f47299e22e2987819994535a8b8f3ef0e1b9b0338a13b6a3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37727.exe

Filesize
468KB

MD5
46ceb5bee28d7be770a67a5ddf309734

SHA1
a5a0011be313ec3a5cbc0a5673942e7bc92d5185

SHA256
3dd4c229e7d73aab1600415ad2e8a4c1d69b0efdd9b6c3c9e0f0fa3b320c3fcb

SHA512
b9ec13fcf51c540ae4d0dc5aa4dbb85dbc426416b981e748e7327544abb1bb25b6c63766949ac6d5127b41db5bad863cb386f9098fa0959aacd183592eec0954

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41937.exe

Filesize
468KB

MD5
229c3523b6481164bb2af070ddd2f061

SHA1
713e971b016f653280375b436a5ef4104070032f

SHA256
6d0142112170b829084ceb0d2d9ad98e299bb5166ad28e0f8b5a5819ce09ae36

SHA512
2ed320e4ce5d060218c363624535d7f70803f05cbcb961f98d23e97266aadc998d17afdf9fdc4852fbb2f88d31c9104bfd2b49978713653e7e78d52771134139

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57231.exe

Filesize
468KB

MD5
0bb85d7a9a42c03b36c44710bd73f5e7

SHA1
cd87646c5e6fbd18994fcd6e81ed441c56dda174

SHA256
aee1f00ce549b1d1aca039357e34cf6fa9faa36a2860de54a90ea26ee7c74eef

SHA512
881cc7633d4057f154a557905e3af1c5b1e22331aefad1f8146a56b6be09891f87db80c92fee3999327c01f4c1446c10aaa92d6e0f0cbcd0c03373ce81aaf1ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe

Filesize
468KB

MD5
305114327a410661117c75f2879746cb

SHA1
4eae5e4fce4343963048cad37e43fddbec844978

SHA256
5294036b0ff584a55262549211ed5decd360ad13097c0f7d9cb2e196439310bf

SHA512
5a0eada6e94d541c4348b2103de40651d1aa3ad268c01f1faeeb2c289744152359f6a8084078daaf21ec3b4f15a3a7cb46f5fa811ebdba6a2f1dc29c1741670a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe

Filesize
468KB

MD5
c7d5ef22d3e8fc37fac1fee59ea0f676

SHA1
f07755ee05d08fab24b2548928db60f42ba576f7

SHA256
6caa85098bf37a71f673965d9c8210b40683d097baece0c4cbef56313f574826

SHA512
1716fec80773c0d8eb2ac246924d25f59fe7481a9a253633d9ca135619d027c527447bd34b2f7208020213d10f78f888073b3e2e37e17a0bceec3e1bd3859faf

Download Submit
memory/432-354-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/432-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/516-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-49-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/536-211-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/536-210-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/536-390-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/536-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-25-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/944-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/992-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1032-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1032-243-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1032-236-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1032-407-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1208-247-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1208-260-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1208-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-324-0x00000000020A0000-0x0000000002115000-memory.dmp

Filesize
468KB

Download
memory/1412-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1484-249-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/1484-364-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/1484-261-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/1540-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1648-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-311-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/1924-304-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/1980-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-312-0x0000000002440000-0x00000000024B5000-memory.dmp

Filesize
468KB

Download
memory/1984-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-212-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2116-394-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2200-309-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2200-80-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2200-308-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2200-171-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2200-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2200-10-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2200-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2200-155-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2200-11-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2232-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-244-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2360-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-129-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2360-411-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2360-256-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2384-287-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2384-291-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2384-144-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2384-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-338-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2480-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-380-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/2640-388-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/2640-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2812-282-0x0000000001F30000-0x0000000001FA5000-memory.dmp

Filesize
468KB

Download
memory/2812-159-0x0000000001F30000-0x0000000001FA5000-memory.dmp

Filesize
468KB

Download
memory/2812-152-0x0000000001F30000-0x0000000001FA5000-memory.dmp

Filesize
468KB

Download
memory/2812-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2812-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2812-284-0x0000000001F30000-0x0000000001FA5000-memory.dmp

Filesize
468KB

Download
memory/2852-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-382-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2860-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-381-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2896-300-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/2896-151-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/2896-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-157-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/2900-95-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2900-342-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2900-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-195-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2900-196-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2900-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-240-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2912-233-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/3016-221-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3016-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-219-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download