d2ca710a870f6228fc4d7da3424aa79b553a094a8b9efe95945db91c97911003

Analysis

max time kernel
114s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbf24badc16ea0d342a74b9f7633ada0N.exe
Size

468KB
MD5

fbf24badc16ea0d342a74b9f7633ada0
SHA1

48e7403dc04fbcb44044b930de7931940082661f
SHA256

d2ca710a870f6228fc4d7da3424aa79b553a094a8b9efe95945db91c97911003
SHA512

3ee3b8a3b3b401f7953ee184b3da0c67789797067610216a26daab037a434abb58d40a5625b0e037ac81f36216b6287c089511d91040c9faa9d2f7fb73e8e9ca
SSDEEP

3072:z4/1ogxxja8U2bY3Pa37qf8/ECqjyIpdymHxw/HO3pV+J3XNVAlV:z4doqjU2APQ7qfG01X3pQpXNV

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2752	Unicorn-13421.exe
2160	Unicorn-43162.exe
2844	Unicorn-49939.exe
2540	Unicorn-266.exe
2984	Unicorn-52160.exe
576	Unicorn-18741.exe
2612	Unicorn-39253.exe
2016	Unicorn-55736.exe
2036	Unicorn-26956.exe
1984	Unicorn-1060.exe
2732	Unicorn-13888.exe
1824	Unicorn-7111.exe
1680	Unicorn-42014.exe
1732	Unicorn-48144.exe
3060	Unicorn-23183.exe
2352	Unicorn-62918.exe
344	Unicorn-4158.exe
1008	Unicorn-4179.exe
1872	Unicorn-12439.exe
1728	Unicorn-30630.exe
684	Unicorn-57272.exe
636	Unicorn-51142.exe
2052	Unicorn-32576.exe
2280	Unicorn-43436.exe
2276	Unicorn-24408.exe
1028	Unicorn-15477.exe
336	Unicorn-24143.exe
2916	Unicorn-43458.exe
2632	Unicorn-23592.exe
2696	Unicorn-2103.exe
2596	Unicorn-7770.exe
2644	Unicorn-2871.exe
2796	Unicorn-63769.exe
2864	Unicorn-55501.exe
1300	Unicorn-61631.exe
1412	Unicorn-14376.exe
1932	Unicorn-60048.exe
2344	Unicorn-26364.exe
2584	Unicorn-2124.exe
2924	Unicorn-61994.exe
2116	Unicorn-31267.exe
2700	Unicorn-61439.exe
2236	Unicorn-61750.exe
1152	Unicorn-14760.exe
608	Unicorn-35273.exe
1268	Unicorn-41403.exe
2948	Unicorn-53555.exe
1468	Unicorn-59685.exe
2208	Unicorn-59685.exe
2944	Unicorn-3639.exe
2428	Unicorn-3639.exe
2148	Unicorn-14574.exe
1760	Unicorn-23505.exe
872	Unicorn-23505.exe
1520	Unicorn-1038.exe
2444	Unicorn-22543.exe
1896	Unicorn-9114.exe
2532	Unicorn-54039.exe
2600	Unicorn-34173.exe
2812	Unicorn-32035.exe
1048	Unicorn-58699.exe
1052	Unicorn-17667.exe
2084	Unicorn-5092.exe
1576	Unicorn-161.exe

Loads dropped DLL 64 IoCs

pid	Process
2748	fbf24badc16ea0d342a74b9f7633ada0N.exe
2748	fbf24badc16ea0d342a74b9f7633ada0N.exe
2752	Unicorn-13421.exe
2752	Unicorn-13421.exe
2748	fbf24badc16ea0d342a74b9f7633ada0N.exe
2748	fbf24badc16ea0d342a74b9f7633ada0N.exe
2160	Unicorn-43162.exe
2160	Unicorn-43162.exe
2752	Unicorn-13421.exe
2752	Unicorn-13421.exe
2844	Unicorn-49939.exe
2844	Unicorn-49939.exe
2748	fbf24badc16ea0d342a74b9f7633ada0N.exe
2748	fbf24badc16ea0d342a74b9f7633ada0N.exe
2540	Unicorn-266.exe
2540	Unicorn-266.exe
2160	Unicorn-43162.exe
2160	Unicorn-43162.exe
576	Unicorn-18741.exe
576	Unicorn-18741.exe
2844	Unicorn-49939.exe
2844	Unicorn-49939.exe
2984	Unicorn-52160.exe
2984	Unicorn-52160.exe
2752	Unicorn-13421.exe
2752	Unicorn-13421.exe
2612	Unicorn-39253.exe
2612	Unicorn-39253.exe
2748	fbf24badc16ea0d342a74b9f7633ada0N.exe
2748	fbf24badc16ea0d342a74b9f7633ada0N.exe
2016	Unicorn-55736.exe
2016	Unicorn-55736.exe
2540	Unicorn-266.exe
2540	Unicorn-266.exe
1984	Unicorn-1060.exe
1984	Unicorn-1060.exe
2160	Unicorn-43162.exe
2160	Unicorn-43162.exe
2732	Unicorn-13888.exe
2732	Unicorn-13888.exe
2844	Unicorn-49939.exe
2036	Unicorn-26956.exe
2844	Unicorn-49939.exe
2036	Unicorn-26956.exe
3060	Unicorn-23183.exe
3060	Unicorn-23183.exe
576	Unicorn-18741.exe
576	Unicorn-18741.exe
2748	fbf24badc16ea0d342a74b9f7633ada0N.exe
1732	Unicorn-48144.exe
2752	Unicorn-13421.exe
2748	fbf24badc16ea0d342a74b9f7633ada0N.exe
1732	Unicorn-48144.exe
2752	Unicorn-13421.exe
1824	Unicorn-7111.exe
1824	Unicorn-7111.exe
2612	Unicorn-39253.exe
2612	Unicorn-39253.exe
2984	Unicorn-52160.exe
2984	Unicorn-52160.exe
2352	Unicorn-62918.exe
2352	Unicorn-62918.exe
2016	Unicorn-55736.exe
2016	Unicorn-55736.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
524	608	WerFault.exe	75

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbf24badc16ea0d342a74b9f7633ada0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-161.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2748	fbf24badc16ea0d342a74b9f7633ada0N.exe
2752	Unicorn-13421.exe
2160	Unicorn-43162.exe
2844	Unicorn-49939.exe
2540	Unicorn-266.exe
2984	Unicorn-52160.exe
576	Unicorn-18741.exe
2612	Unicorn-39253.exe
2016	Unicorn-55736.exe
2036	Unicorn-26956.exe
1984	Unicorn-1060.exe
2732	Unicorn-13888.exe
1680	Unicorn-42014.exe
1824	Unicorn-7111.exe
1732	Unicorn-48144.exe
3060	Unicorn-23183.exe
2352	Unicorn-62918.exe
344	Unicorn-4158.exe
1008	Unicorn-4179.exe
1872	Unicorn-12439.exe
1728	Unicorn-30630.exe
636	Unicorn-51142.exe
684	Unicorn-57272.exe
2276	Unicorn-24408.exe
2052	Unicorn-32576.exe
2280	Unicorn-43436.exe
1028	Unicorn-15477.exe
2916	Unicorn-43458.exe
2632	Unicorn-23592.exe
2696	Unicorn-2103.exe
336	Unicorn-24143.exe
2596	Unicorn-7770.exe
2644	Unicorn-2871.exe
2796	Unicorn-63769.exe
2344	Unicorn-26364.exe
1412	Unicorn-14376.exe
2864	Unicorn-55501.exe
1932	Unicorn-60048.exe
1300	Unicorn-61631.exe
2584	Unicorn-2124.exe
2924	Unicorn-61994.exe
2116	Unicorn-31267.exe
2700	Unicorn-61439.exe
2236	Unicorn-61750.exe
1152	Unicorn-14760.exe
608	Unicorn-35273.exe
1268	Unicorn-41403.exe
2948	Unicorn-53555.exe
1468	Unicorn-59685.exe
2208	Unicorn-59685.exe
1760	Unicorn-23505.exe
2428	Unicorn-3639.exe
2148	Unicorn-14574.exe
872	Unicorn-23505.exe
2444	Unicorn-22543.exe
1520	Unicorn-1038.exe
1896	Unicorn-9114.exe
2532	Unicorn-54039.exe
2600	Unicorn-34173.exe
2812	Unicorn-32035.exe
1048	Unicorn-58699.exe
1052	Unicorn-17667.exe
2084	Unicorn-5092.exe
1576	Unicorn-161.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2752	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	31
PID 2748 wrote to memory of 2752	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	31
PID 2748 wrote to memory of 2752	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	31
PID 2748 wrote to memory of 2752	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	31
PID 2752 wrote to memory of 2160	2752	Unicorn-13421.exe	32
PID 2752 wrote to memory of 2160	2752	Unicorn-13421.exe	32
PID 2752 wrote to memory of 2160	2752	Unicorn-13421.exe	32
PID 2752 wrote to memory of 2160	2752	Unicorn-13421.exe	32
PID 2748 wrote to memory of 2844	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	33
PID 2748 wrote to memory of 2844	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	33
PID 2748 wrote to memory of 2844	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	33
PID 2748 wrote to memory of 2844	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	33
PID 2160 wrote to memory of 2540	2160	Unicorn-43162.exe	34
PID 2160 wrote to memory of 2540	2160	Unicorn-43162.exe	34
PID 2160 wrote to memory of 2540	2160	Unicorn-43162.exe	34
PID 2160 wrote to memory of 2540	2160	Unicorn-43162.exe	34
PID 2752 wrote to memory of 2984	2752	Unicorn-13421.exe	35
PID 2752 wrote to memory of 2984	2752	Unicorn-13421.exe	35
PID 2752 wrote to memory of 2984	2752	Unicorn-13421.exe	35
PID 2752 wrote to memory of 2984	2752	Unicorn-13421.exe	35
PID 2844 wrote to memory of 576	2844	Unicorn-49939.exe	36
PID 2844 wrote to memory of 576	2844	Unicorn-49939.exe	36
PID 2844 wrote to memory of 576	2844	Unicorn-49939.exe	36
PID 2844 wrote to memory of 576	2844	Unicorn-49939.exe	36
PID 2748 wrote to memory of 2612	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	37
PID 2748 wrote to memory of 2612	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	37
PID 2748 wrote to memory of 2612	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	37
PID 2748 wrote to memory of 2612	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	37
PID 2540 wrote to memory of 2016	2540	Unicorn-266.exe	38
PID 2540 wrote to memory of 2016	2540	Unicorn-266.exe	38
PID 2540 wrote to memory of 2016	2540	Unicorn-266.exe	38
PID 2540 wrote to memory of 2016	2540	Unicorn-266.exe	38
PID 2160 wrote to memory of 1984	2160	Unicorn-43162.exe	39
PID 2160 wrote to memory of 1984	2160	Unicorn-43162.exe	39
PID 2160 wrote to memory of 1984	2160	Unicorn-43162.exe	39
PID 2160 wrote to memory of 1984	2160	Unicorn-43162.exe	39
PID 576 wrote to memory of 2036	576	Unicorn-18741.exe	40
PID 576 wrote to memory of 2036	576	Unicorn-18741.exe	40
PID 576 wrote to memory of 2036	576	Unicorn-18741.exe	40
PID 576 wrote to memory of 2036	576	Unicorn-18741.exe	40
PID 2844 wrote to memory of 2732	2844	Unicorn-49939.exe	41
PID 2844 wrote to memory of 2732	2844	Unicorn-49939.exe	41
PID 2844 wrote to memory of 2732	2844	Unicorn-49939.exe	41
PID 2844 wrote to memory of 2732	2844	Unicorn-49939.exe	41
PID 2984 wrote to memory of 1824	2984	Unicorn-52160.exe	42
PID 2984 wrote to memory of 1824	2984	Unicorn-52160.exe	42
PID 2984 wrote to memory of 1824	2984	Unicorn-52160.exe	42
PID 2984 wrote to memory of 1824	2984	Unicorn-52160.exe	42
PID 2752 wrote to memory of 1680	2752	Unicorn-13421.exe	43
PID 2752 wrote to memory of 1680	2752	Unicorn-13421.exe	43
PID 2752 wrote to memory of 1680	2752	Unicorn-13421.exe	43
PID 2752 wrote to memory of 1680	2752	Unicorn-13421.exe	43
PID 2612 wrote to memory of 1732	2612	Unicorn-39253.exe	44
PID 2612 wrote to memory of 1732	2612	Unicorn-39253.exe	44
PID 2612 wrote to memory of 1732	2612	Unicorn-39253.exe	44
PID 2612 wrote to memory of 1732	2612	Unicorn-39253.exe	44
PID 2748 wrote to memory of 3060	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	45
PID 2748 wrote to memory of 3060	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	45
PID 2748 wrote to memory of 3060	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	45
PID 2748 wrote to memory of 3060	2748	fbf24badc16ea0d342a74b9f7633ada0N.exe	45
PID 2016 wrote to memory of 2352	2016	Unicorn-55736.exe	46
PID 2016 wrote to memory of 2352	2016	Unicorn-55736.exe	46
PID 2016 wrote to memory of 2352	2016	Unicorn-55736.exe	46
PID 2016 wrote to memory of 2352	2016	Unicorn-55736.exe	46

C:\Users\Admin\AppData\Local\Temp\fbf24badc16ea0d342a74b9f7633ada0N.exe
"C:\Users\Admin\AppData\Local\Temp\fbf24badc16ea0d342a74b9f7633ada0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13421.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13421.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55736.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7770.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        9⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        9⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
        9⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        9⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        9⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
        8⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48393.exe
        8⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43965.exe
        9⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29665.exe
        8⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26774.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45482.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        8⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21055.exe
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
        8⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exe
        7⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59814.exe
        7⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2871.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17667.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21689.exe
        8⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
        9⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        9⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        9⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        9⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        8⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        8⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50832.exe
        7⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        8⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34909.exe
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        7⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        7⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        7⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25342.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        8⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        9⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        9⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        8⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        8⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37836.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34268.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6286.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2878.exe
        7⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60707.exe
        6⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        7⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21055.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
        6⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13386.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        6⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55501.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        6⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        7⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        7⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        6⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-764.exe
        5⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        6⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        6⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        5⤵
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26055.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9062.exe
        5⤵
        
        PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49846.exe
        7⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22679.exe
        8⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exe
        8⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33752.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44755.exe
        6⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
        7⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
        7⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        6⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17069.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe
        6⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52752.exe
        6⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45482.exe
        7⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        7⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        6⤵
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        6⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
        5⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13281.exe
        6⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28226.exe
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
        6⤵
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22679.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        5⤵
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7360.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        5⤵
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26364.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        5⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        6⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        6⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13472.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
      4⤵
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        5⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
      4⤵
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20138.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32977.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
      4⤵
      PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43458.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8533.exe
        7⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
        7⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
        6⤵
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        6⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        5⤵
        Executes dropped EXE
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23679.exe
        5⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        6⤵
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63411.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        6⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        5⤵
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
        6⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64232.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63982.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        7⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        6⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30795.exe
        5⤵
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        5⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59571.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2071.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        5⤵
        
        PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
      4⤵
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6286.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34909.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16836.exe
      4⤵
      PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        5⤵
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15628.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9850.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        6⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36660.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7640.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46430.exe
      4⤵
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62690.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50883.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        5⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44314.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
      4⤵
      PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16836.exe
      4⤵
      PID:5164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36930.exe
        5⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
      4⤵
      PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36593.exe
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7570.exe
      4⤵
      PID:6656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
      4⤵
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41590.exe
        5⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
      4⤵
      PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
      4⤵
      PID:1100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
    3⤵
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19416.exe
      4⤵
      PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18211.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
      4⤵
      PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
      4⤵
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10330.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63953.exe
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17528.exe
    3⤵
    PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
    3⤵
    PID:5332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49939.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49939.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18741.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26956.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54039.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28740.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        6⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
        6⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38259.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        7⤵
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        6⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        5⤵
        
        PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe
        5⤵
        
        PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43436.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        7⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45888.exe
        6⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
        5⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        6⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        5⤵
        
        PID:480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63570.exe
        6⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
      4⤵
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12920.exe
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
      4⤵
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        6⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        6⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34495.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
        6⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
        5⤵
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45212.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
        5⤵
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        5⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        6⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        5⤵
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36415.exe
        5⤵
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
      4⤵
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        5⤵
        
        PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
      4⤵
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
      4⤵
      PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51142.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61439.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49846.exe
        5⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8066.exe
        6⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38259.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        7⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42248.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23410.exe
        6⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
      4⤵
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17059.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        6⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
      4⤵
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14423.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18078.exe
        5⤵
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51880.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
      4⤵
      PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
      4⤵
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34909.exe
        5⤵
        
        PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8293.exe
      4⤵
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9708.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
    3⤵
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25766.exe
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56615.exe
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26802.exe
    3⤵
    PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe
    3⤵
    PID:5344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48144.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54293.exe
        5⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18731.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8481.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5823.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
        5⤵
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42280.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        5⤵
        
        PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
      4⤵
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe
      4⤵
      PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        5⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44063.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
      4⤵
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21301.exe
      4⤵
      PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 236
      4⤵
      Program crash
      PID:524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36857.exe
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
    3⤵
    PID:4936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59998.exe
    3⤵
    PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
    3⤵
    PID:7056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9114.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17278.exe
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
        5⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        5⤵
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
      4⤵
      PID:5796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34173.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
      4⤵
      PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exe
      4⤵
      PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
    3⤵
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
    3⤵
    PID:6124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
      4⤵
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        5⤵
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45461.exe
      4⤵
      PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27990.exe
      4⤵
      PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51232.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51398.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
      4⤵
      PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7360.exe
    3⤵
    PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42533.exe
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22543.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22543.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62529.exe
    3⤵
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
      4⤵
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
      4⤵
      PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
    3⤵
    PID:4200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
    3⤵
    PID:5976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50621.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50621.exe
  2⤵
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60095.exe
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exe
    3⤵
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
    3⤵
    PID:5848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21301.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21301.exe
  2⤵
  PID:3444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
  2⤵
  PID:4384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
  2⤵
  PID:5832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe

Filesize
468KB

MD5
9980b4930165e8f7ddcc95dd0cbbb821

SHA1
b36a6b8476eff3d81f5c330feaf82aa271612976

SHA256
967e4d14ec6df0c51fafdc814a05139b981d16029614027feb250e2973a7bca4

SHA512
86ac62d45764506b468089805037ea758f338839f4bf25ed2339f03739b5cfb70364145cb480bc433fab3248a2e2cde8b7a7fa2c96ab5e3e6c08d49678a8be3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18741.exe

Filesize
468KB

MD5
f126e3c6b1e38aacf1b7cd099d5791f3

SHA1
3e74e5151ba11db4b6f17b571fd14b2a9148a575

SHA256
536c0df242b4be138d6163132fb081809d04860bc2954a8546394a6d957fd0b2

SHA512
e484c5a176a1af38ce083bd1e1c0339e6eba154207d10bbea74b8230db34f8dc14c1486be03681ac29c7262bef47f659a9234fa3768a950656f2487333ecb1d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe

Filesize
468KB

MD5
d2223b5dbbb164d251f0fb2941460fe5

SHA1
5f15238b838d0a37cc817fe68488b0e54a4bb844

SHA256
20a1d4023a543a5b1fdbbc497bf77376f0f3b59bf0de07cf496877ef86a4308a

SHA512
a0ee1ff090085bebb2093ce74ebc3ef30ad824adca1f2c2b9b8c48f898f929b57273b0719128aa4d00294f0bb12b40b0b2c3c03af3adb60f941f4fe8e3ad9bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26956.exe

Filesize
468KB

MD5
680eff56f04616935494c715d3b2fd38

SHA1
7f6d8284c6fce6b8f1877faf2c590ff328b52e08

SHA256
a5b66f28cba138ac1466c2ca1ebc0e1e1a31a7eb1d3f215f23bf8b8cde7d1615

SHA512
e35d133a971901161a4d05ac6ee8f3877f2b7679f88e57db3668b4be124ad5feda7b5232832848fc4d5097c982e13869ccb30d0811a186fe4ad39ae0e3db11fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe

Filesize
468KB

MD5
6ecee666a95f0b9ad605d342bb9c35d9

SHA1
23c222910eba15c1b55e6945cafb0c86f9109301

SHA256
5e42e058bd8186db215436b7e0e7bc723391d7da1908041376de11c6a66c1562

SHA512
4518935692d0690c1b93962d4668db66e71e93bd3c09bedc11c85f997cfcd2d7da87e17731c810f06736054aa19c15b20f61a1e9fc164305b4daee8ab8b0fbbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42280.exe

Filesize
468KB

MD5
220c59dc620d5a54f78977abfd6bbcb8

SHA1
f7fca641fee54e0ab3e07b567da50726bbe2c8cc

SHA256
ebf87c9c1ab8e67e90075acfeec5d69489d7cf17a894f258924d4e26812b1e90

SHA512
8b839fe0b88e7e7e6aa962670d3f6e5ee1b8a072173f876be0435d9d7fed6899d7d150085fe985fbdd2b15553f93f63b0973eec5664c0ab01c3a7455614bed78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe

Filesize
468KB

MD5
09cc11d8aba476b3ba2347d545259d26

SHA1
913cf66889f460b37a9d3a00174218d216f55544

SHA256
d8b47f46c282f1f1861af35b6053bb9a0033f86e8cae52cd6bc9a107c8dec583

SHA512
f18ba8db094c8279e8f0a289e1ac4fe9e30808d0ade0cb024514c792ba7cdc2461a4273db81666e8997e18f9d7e999d7dfc619c36d9e8fd185eae3b359124408

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe

Filesize
468KB

MD5
c42bceb7b7fd239de4ccb66ad4f2d954

SHA1
775b50b7c2a37aad4350695dc8a9e04cceda81b8

SHA256
d7d13500d1f69d876ece5c27681a7c3326f54481a05f6867672684696950d588

SHA512
f4b84a3182b6307391ce100eb24dbcaa09b76a5067eb8942b219a6b95edcff6d6828378028cf75baca0ef8e165d6d7476aea1cdba4126958ca294ed5b8f790db

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe

Filesize
468KB

MD5
d26527adc620d0dc44261b7699943f86

SHA1
1d457646566fe026d7ff592e9328f14ba896440c

SHA256
0ccb301d555ff86eb5e946ec66b0fdcb0af67d821cfb4df745ec5722fc5c773a

SHA512
584324f03bc3148bb03a94c09d01207399f3227855bcaf68b3da6ca67f0b6639486eb3e0d0e2ea44d09e6512a4074a53626e9b1ea2f5b6fdd4d888cafc10a045

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13421.exe

Filesize
468KB

MD5
2ed0fa2368df316e9144b181c8445d00

SHA1
379e7068ab89bfa3f6b6e580d8a484a599239adb

SHA256
7e87c2fb10656cc5e8efcb45934a16f2827cd451e858b7fa2e8454981649b099

SHA512
7d619d46aa096631f46af7dd458f01c31c60475074072be86c9f453be0bfa5324120fb6313f606311a93d1c2a3c60a2afec75496f667cc44a301f866f85480ed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-266.exe

Filesize
468KB

MD5
23eea79d89f293a30b5ab0b18282a9e8

SHA1
f4b31978e5cd08c02c99dded3dde6806aa6f5f40

SHA256
2cbcb33d69daaa8522a7c3393fd9575ad93e49335293212659df0a16399c885d

SHA512
4d99e4c7ed07bd3e606fbe908b42dd364aa1f0db3123a756b7ef9d8e6536b0c201a0762ba4f4e4e9ca1b9277169a2d6dfc5df3b32e8e06a969527186aea3cb6d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe

Filesize
468KB

MD5
20305302ac4db7cec938ec1653bc5e7d

SHA1
ca67eaea28f4fe761410c0d97d1d90b3ef91ecb0

SHA256
fbeb5ce650ef8da5704572671f205850017aa792ae38751ccf952e87f1d64bf4

SHA512
7de9f8f567f155a1db02606b9f25a6f36464d4ad3e229abe932114285fe3d595161d86179d16f913fc167fd59ecf2024309a4848dcff7e299f22298650288473

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe

Filesize
468KB

MD5
6f710b20daaaf28b46028d88d4e32270

SHA1
7eb0d1bd49589b14c1f38e207cfeba30f8e5adfa

SHA256
6582b0ef75d5323a8be47af9f1e64b6bea0722e98c6e15725852325528d5c794

SHA512
820b5a2a13178b49955d964a6cea57a7081e4e0a31d376d36e647562f835109530c81ebac762ffefd5993fd3e90462f01aa4ba538e110b830926dc5cbd7a17fe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe

Filesize
468KB

MD5
caaff32f1ac12c910f15e71947431e8b

SHA1
41b6480140667ab1a5a617e4b125a4b7ebda320f

SHA256
037ebd354b94ad6f3bab4129fe55e98f9a2904f2e679d377e1583e70cbb34b29

SHA512
4872876833e28fd9d719d9aa836162a0c5ad66327b40c980549ec99d9522f44f344964e6ef4c230ece43c302f57c4f2cde93168584a22d5194a2ee8e3145e191

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe

Filesize
468KB

MD5
e7906d423e5b5c2312c5d74606b3756b

SHA1
01a6556df6fa54ea9f71b2b031baf168ebdbba54

SHA256
0bd3b05d02bf7acb7a811b01b6089d79d991e9624a986eaea9a2cd660f18f06d

SHA512
d54a55e063a4b6e0da3e45614594d5cd4b7f93f8aab1dfd17d285acd981d8961dfb172714f384152df9cbdd49459a63d6ac3aa35e84eb4bc09c8ae0cfe3a2d68

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48144.exe

Filesize
468KB

MD5
cd63f8c65c09a36395eb1d471da4edf6

SHA1
e44d0b695d43313fc17755e1c937756f6307c44d

SHA256
1c3ec1284f3dbb8bdd7cfd6756e3f76d1beedfe071bc27d2b5f31e54879a500d

SHA512
d84999ad37aa19b897627d346181f3715e7042782105ed4980308a9e7be2ad13d3b87c2b9e247f8937b63ac02dbb99770990f8f3b11ac979a7c69fae42b05114

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49939.exe

Filesize
468KB

MD5
f1b9d01d7e054e3f9285395b38d2c5ce

SHA1
7af9ab8de996b5a142d826888e850c729994b085

SHA256
5ca89424f0b4bfd41828ef9986276478a780bffef88bfb0276fc5b4c2ababc8b

SHA512
29201fb3b55b40125525a2611e6837615c9bc3d3a438c23c3a40518bc933182dbc1227b776814bf55734fcfdee07e807878c540e8388a0da27b7ffffe7b49340

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe

Filesize
468KB

MD5
89f40da6dc7dcd645ae870448f7f6641

SHA1
fa5c84e410e6ed6a12daa0e0dd6d51653d96aeb4

SHA256
e402b9c2214c6b61d2f45b46b064a6c45425ce51bdadaa13867d7758573b2912

SHA512
bff362271cf4eb450f3b95e14a39fe202e1946e2bdb55c08bf7f9d8f871964f8dfff8892aefbc2199eac8e15d2756a05f768d2c0da0b4d8272e930d4f443cb7c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55736.exe

Filesize
468KB

MD5
2dfb53ceb9375faa515f36844346b8da

SHA1
deae9b2c33e451267e65c99208b38092ddd5e530

SHA256
09b3b160ad8f8857fd2e999ab0028e68806a3a92195603cb7568f046bb5d0f54

SHA512
4e9621a79e344c1f0f55623914ac03381918cab5425c89dcf66da48279572ee94a18f7be3fe338fc3daff2e1f57fe3fa5ccacd472550246ecb49ce4b2d25ac01

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe

Filesize
468KB

MD5
89bf69b482af6fdf352437000762e04f

SHA1
01a4f00d625ed9b95e6978cedb74e79c8f5a4886

SHA256
5174cd4932fe3f7333e1bf362f73af0ef11fc4a3a6292bf545e0cd4278bd3534

SHA512
ccc3544e7deed76d53c05e87e93ac273a9b619e2062995e1971af290e0093a6de9bc6dbef1b3eb95d186ad094d2e7cee658fa952f4201dd0980088e5824b3fdc

Download Submit
memory/336-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/344-378-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/344-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/576-284-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/576-285-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/636-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/684-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1008-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1008-395-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/1008-389-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/1028-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1300-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-306-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1732-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-325-0x0000000001EC0000-0x0000000001F35000-memory.dmp

Filesize
468KB

Download
memory/1824-322-0x0000000001EC0000-0x0000000001F35000-memory.dmp

Filesize
468KB

Download
memory/1872-413-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1872-403-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1872-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-226-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1984-219-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1984-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-200-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2016-199-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2016-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-257-0x0000000001D20000-0x0000000001D95000-memory.dmp

Filesize
468KB

Download
memory/2036-267-0x0000000001D20000-0x0000000001D95000-memory.dmp

Filesize
468KB

Download
memory/2036-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-411-0x0000000002C40000-0x0000000002CB5000-memory.dmp

Filesize
468KB

Download
memory/2160-50-0x0000000003770000-0x00000000037E5000-memory.dmp

Filesize
468KB

Download
memory/2160-238-0x0000000003770000-0x00000000037E5000-memory.dmp

Filesize
468KB

Download
memory/2160-237-0x0000000003770000-0x00000000037E5000-memory.dmp

Filesize
468KB

Download
memory/2160-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-358-0x0000000002500000-0x0000000002575000-memory.dmp

Filesize
468KB

Download
memory/2540-53-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-383-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2540-207-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2540-213-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2596-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-170-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-169-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-323-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-330-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-247-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2732-249-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2732-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-310-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2748-183-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2748-364-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2748-11-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2748-10-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2748-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-305-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2748-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-369-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2748-181-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2752-308-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/2752-307-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/2752-387-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/2752-57-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/2752-25-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/2752-24-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/2752-158-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/2752-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-77-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2844-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-265-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2844-133-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2844-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-134-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2844-255-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2844-74-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2916-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-337-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/2984-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-147-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/2984-333-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/2984-140-0x0000000001E90000-0x0000000001F05000-memory.dmp

Filesize
468KB

Download
memory/3060-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3060-275-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/3060-274-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download