d07bee059ed8ee8f9114f39d0d3db5b4bbba624a94204cf26e76b36f9fc3d05f

Analysis

max time kernel
116s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fbaf6a5c39a4263037537b0d1a2fa660N.exe
Size

468KB
MD5

fbaf6a5c39a4263037537b0d1a2fa660
SHA1

24d9eca4c11070fe079dc9c13cca53aceb09a835
SHA256

d07bee059ed8ee8f9114f39d0d3db5b4bbba624a94204cf26e76b36f9fc3d05f
SHA512

59971b8fe6e1ab16e945945e76481182b806dc13d932b8fe6d2c9b42f9747943d2f6af36e1ca0d782d669321bdfb1b9d47ab810858a3559d305ab0f23fa4dc53
SSDEEP

3072:th8IowLdji8U6bYCfz5Sfp5EChj+IpBnmHdaV4r2Is3fSNOm6lL:thnoYbU6hf1SfpU0Ez2Ii6NOm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2844	Unicorn-41669.exe
2152	Unicorn-9442.exe
2336	Unicorn-10833.exe
2756	Unicorn-44850.exe
2908	Unicorn-61278.exe
2812	Unicorn-1871.exe
2808	Unicorn-2426.exe
2880	Unicorn-44933.exe
1248	Unicorn-40033.exe
1444	Unicorn-45509.exe
2040	Unicorn-33257.exe
112	Unicorn-65472.exe
1616	Unicorn-45872.exe
1612	Unicorn-200.exe
1604	Unicorn-59607.exe
2984	Unicorn-2577.exe
236	Unicorn-64585.exe
956	Unicorn-16968.exe
1108	Unicorn-33395.exe
1632	Unicorn-61892.exe
1288	Unicorn-15384.exe
2500	Unicorn-57808.exe
1668	Unicorn-56801.exe
1412	Unicorn-58384.exe
1240	Unicorn-25063.exe
544	Unicorn-19197.exe
1608	Unicorn-25882.exe
2680	Unicorn-40902.exe
3044	Unicorn-25328.exe
2828	Unicorn-42624.exe
2636	Unicorn-59707.exe
1572	Unicorn-14035.exe
2620	Unicorn-3821.exe
2676	Unicorn-42432.exe
2328	Unicorn-59515.exe
1396	Unicorn-22588.exe
1912	Unicorn-50911.exe
2432	Unicorn-51176.exe
1364	Unicorn-57953.exe
1852	Unicorn-12281.exe
316	Unicorn-12281.exe
1720	Unicorn-12373.exe
2904	Unicorn-27034.exe
1428	Unicorn-61845.exe
2584	Unicorn-63428.exe
2972	Unicorn-27549.exe
1688	Unicorn-40112.exe
1648	Unicorn-10205.exe
896	Unicorn-60797.exe
332	Unicorn-7704.exe
1724	Unicorn-1574.exe
2072	Unicorn-48637.exe
996	Unicorn-13542.exe
2372	Unicorn-52437.exe
3056	Unicorn-1845.exe
2868	Unicorn-37476.exe
2476	Unicorn-46407.exe
2644	Unicorn-6551.exe
2672	Unicorn-42899.exe
2496	Unicorn-8643.exe
2312	Unicorn-48737.exe
1996	Unicorn-20048.exe
1692	Unicorn-60989.exe
1768	Unicorn-36485.exe

Loads dropped DLL 64 IoCs

pid	Process
1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe
1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe
1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe
1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe
2844	Unicorn-41669.exe
2844	Unicorn-41669.exe
2152	Unicorn-9442.exe
2152	Unicorn-9442.exe
1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe
2336	Unicorn-10833.exe
2336	Unicorn-10833.exe
1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe
2844	Unicorn-41669.exe
2844	Unicorn-41669.exe
2756	Unicorn-44850.exe
2756	Unicorn-44850.exe
2152	Unicorn-9442.exe
2152	Unicorn-9442.exe
2812	Unicorn-1871.exe
2812	Unicorn-1871.exe
2808	Unicorn-2426.exe
2808	Unicorn-2426.exe
1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe
2908	Unicorn-61278.exe
2336	Unicorn-10833.exe
2844	Unicorn-41669.exe
1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe
2336	Unicorn-10833.exe
2844	Unicorn-41669.exe
2908	Unicorn-61278.exe
2880	Unicorn-44933.exe
2880	Unicorn-44933.exe
2756	Unicorn-44850.exe
2756	Unicorn-44850.exe
1248	Unicorn-40033.exe
1248	Unicorn-40033.exe
2152	Unicorn-9442.exe
2152	Unicorn-9442.exe
2040	Unicorn-33257.exe
2040	Unicorn-33257.exe
2808	Unicorn-2426.exe
2808	Unicorn-2426.exe
1444	Unicorn-45509.exe
1444	Unicorn-45509.exe
2812	Unicorn-1871.exe
2812	Unicorn-1871.exe
1604	Unicorn-59607.exe
1604	Unicorn-59607.exe
2336	Unicorn-10833.exe
2844	Unicorn-41669.exe
2844	Unicorn-41669.exe
2336	Unicorn-10833.exe
2908	Unicorn-61278.exe
1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe
2908	Unicorn-61278.exe
1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe
1612	Unicorn-200.exe
1612	Unicorn-200.exe
2984	Unicorn-2577.exe
2984	Unicorn-2577.exe
2880	Unicorn-44933.exe
236	Unicorn-64585.exe
2880	Unicorn-44933.exe
236	Unicorn-64585.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13402.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe
2844	Unicorn-41669.exe
2152	Unicorn-9442.exe
2336	Unicorn-10833.exe
2756	Unicorn-44850.exe
2808	Unicorn-2426.exe
2908	Unicorn-61278.exe
2812	Unicorn-1871.exe
2880	Unicorn-44933.exe
1248	Unicorn-40033.exe
2040	Unicorn-33257.exe
1444	Unicorn-45509.exe
1612	Unicorn-200.exe
1604	Unicorn-59607.exe
1616	Unicorn-45872.exe
112	Unicorn-65472.exe
2984	Unicorn-2577.exe
236	Unicorn-64585.exe
956	Unicorn-16968.exe
1108	Unicorn-33395.exe
1288	Unicorn-15384.exe
1632	Unicorn-61892.exe
2500	Unicorn-57808.exe
1668	Unicorn-56801.exe
1412	Unicorn-58384.exe
544	Unicorn-19197.exe
1240	Unicorn-25063.exe
2680	Unicorn-40902.exe
1608	Unicorn-25882.exe
3044	Unicorn-25328.exe
2828	Unicorn-42624.exe
2636	Unicorn-59707.exe
1572	Unicorn-14035.exe
2620	Unicorn-3821.exe
2676	Unicorn-42432.exe
2328	Unicorn-59515.exe
1852	Unicorn-12281.exe
1912	Unicorn-50911.exe
316	Unicorn-12281.exe
1364	Unicorn-57953.exe
1396	Unicorn-22588.exe
1720	Unicorn-12373.exe
2432	Unicorn-51176.exe
1428	Unicorn-61845.exe
2584	Unicorn-63428.exe
2904	Unicorn-27034.exe
332	Unicorn-7704.exe
896	Unicorn-60797.exe
2972	Unicorn-27549.exe
1688	Unicorn-40112.exe
1648	Unicorn-10205.exe
1724	Unicorn-1574.exe
996	Unicorn-13542.exe
2072	Unicorn-48637.exe
2372	Unicorn-52437.exe
3056	Unicorn-1845.exe
2868	Unicorn-37476.exe
2476	Unicorn-46407.exe
2644	Unicorn-6551.exe
2672	Unicorn-42899.exe
2496	Unicorn-8643.exe
2312	Unicorn-48737.exe
1768	Unicorn-36485.exe
1692	Unicorn-60989.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2844	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	30
PID 1628 wrote to memory of 2844	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	30
PID 1628 wrote to memory of 2844	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	30
PID 1628 wrote to memory of 2844	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	30
PID 1628 wrote to memory of 2152	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	32
PID 1628 wrote to memory of 2152	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	32
PID 1628 wrote to memory of 2152	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	32
PID 1628 wrote to memory of 2152	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	32
PID 2844 wrote to memory of 2336	2844	Unicorn-41669.exe	33
PID 2844 wrote to memory of 2336	2844	Unicorn-41669.exe	33
PID 2844 wrote to memory of 2336	2844	Unicorn-41669.exe	33
PID 2844 wrote to memory of 2336	2844	Unicorn-41669.exe	33
PID 2152 wrote to memory of 2756	2152	Unicorn-9442.exe	34
PID 2152 wrote to memory of 2756	2152	Unicorn-9442.exe	34
PID 2152 wrote to memory of 2756	2152	Unicorn-9442.exe	34
PID 2152 wrote to memory of 2756	2152	Unicorn-9442.exe	34
PID 2336 wrote to memory of 2812	2336	Unicorn-10833.exe	36
PID 2336 wrote to memory of 2812	2336	Unicorn-10833.exe	36
PID 2336 wrote to memory of 2812	2336	Unicorn-10833.exe	36
PID 2336 wrote to memory of 2812	2336	Unicorn-10833.exe	36
PID 1628 wrote to memory of 2908	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	35
PID 1628 wrote to memory of 2908	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	35
PID 1628 wrote to memory of 2908	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	35
PID 1628 wrote to memory of 2908	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	35
PID 2844 wrote to memory of 2808	2844	Unicorn-41669.exe	37
PID 2844 wrote to memory of 2808	2844	Unicorn-41669.exe	37
PID 2844 wrote to memory of 2808	2844	Unicorn-41669.exe	37
PID 2844 wrote to memory of 2808	2844	Unicorn-41669.exe	37
PID 2756 wrote to memory of 2880	2756	Unicorn-44850.exe	38
PID 2756 wrote to memory of 2880	2756	Unicorn-44850.exe	38
PID 2756 wrote to memory of 2880	2756	Unicorn-44850.exe	38
PID 2756 wrote to memory of 2880	2756	Unicorn-44850.exe	38
PID 2152 wrote to memory of 1248	2152	Unicorn-9442.exe	39
PID 2152 wrote to memory of 1248	2152	Unicorn-9442.exe	39
PID 2152 wrote to memory of 1248	2152	Unicorn-9442.exe	39
PID 2152 wrote to memory of 1248	2152	Unicorn-9442.exe	39
PID 2812 wrote to memory of 1444	2812	Unicorn-1871.exe	40
PID 2812 wrote to memory of 1444	2812	Unicorn-1871.exe	40
PID 2812 wrote to memory of 1444	2812	Unicorn-1871.exe	40
PID 2812 wrote to memory of 1444	2812	Unicorn-1871.exe	40
PID 2808 wrote to memory of 2040	2808	Unicorn-2426.exe	41
PID 2808 wrote to memory of 2040	2808	Unicorn-2426.exe	41
PID 2808 wrote to memory of 2040	2808	Unicorn-2426.exe	41
PID 2808 wrote to memory of 2040	2808	Unicorn-2426.exe	41
PID 1628 wrote to memory of 112	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	42
PID 1628 wrote to memory of 112	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	42
PID 1628 wrote to memory of 112	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	42
PID 1628 wrote to memory of 112	1628	fbaf6a5c39a4263037537b0d1a2fa660N.exe	42
PID 2336 wrote to memory of 1616	2336	Unicorn-10833.exe	44
PID 2336 wrote to memory of 1616	2336	Unicorn-10833.exe	44
PID 2336 wrote to memory of 1616	2336	Unicorn-10833.exe	44
PID 2336 wrote to memory of 1616	2336	Unicorn-10833.exe	44
PID 2844 wrote to memory of 1604	2844	Unicorn-41669.exe	45
PID 2844 wrote to memory of 1604	2844	Unicorn-41669.exe	45
PID 2844 wrote to memory of 1604	2844	Unicorn-41669.exe	45
PID 2844 wrote to memory of 1604	2844	Unicorn-41669.exe	45
PID 2908 wrote to memory of 1612	2908	Unicorn-61278.exe	43
PID 2908 wrote to memory of 1612	2908	Unicorn-61278.exe	43
PID 2908 wrote to memory of 1612	2908	Unicorn-61278.exe	43
PID 2908 wrote to memory of 1612	2908	Unicorn-61278.exe	43
PID 2880 wrote to memory of 2984	2880	Unicorn-44933.exe	46
PID 2880 wrote to memory of 2984	2880	Unicorn-44933.exe	46
PID 2880 wrote to memory of 2984	2880	Unicorn-44933.exe	46
PID 2880 wrote to memory of 2984	2880	Unicorn-44933.exe	46

C:\Users\Admin\AppData\Local\Temp\fbaf6a5c39a4263037537b0d1a2fa660N.exe
"C:\Users\Admin\AppData\Local\Temp\fbaf6a5c39a4263037537b0d1a2fa660N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41669.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41669.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10833.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1871.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12281.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
        8⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        9⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        9⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17158.exe
        9⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        9⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        9⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21850.exe
        8⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exe
        8⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        8⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        8⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        8⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2997.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28613.exe
        8⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        8⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        8⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
        8⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38664.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61845.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28613.exe
        7⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16115.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        7⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55539.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
        7⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18700.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        7⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        6⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17434.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
        6⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62031.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        5⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7425.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62317.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        5⤵
        
        PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11482.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        6⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        6⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        6⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31013.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28805.exe
        6⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59541.exe
        5⤵
        
        PID:700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19197.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        7⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        6⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
        5⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53776.exe
        6⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        5⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        5⤵
        
        PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61757.exe
        5⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14414.exe
        6⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42182.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54164.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48250.exe
      4⤵
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29546.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28367.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        5⤵
        
        PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
      4⤵
      PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47353.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
      4⤵
      PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2426.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33257.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        8⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        8⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        8⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63210.exe
        7⤵
        
        PID:280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7590.exe
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25747.exe
        6⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47362.exe
        7⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        7⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39094.exe
        6⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57865.exe
        6⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
        7⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
        7⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
        6⤵
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62031.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        6⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
        5⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-491.exe
        6⤵
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        6⤵
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        5⤵
        
        PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12281.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        7⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54715.exe
        6⤵
        
        PID:272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64553.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        6⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
        5⤵
        
        PID:672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        5⤵
        
        PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12373.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        5⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50626.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59941.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53750.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe
      4⤵
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        5⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        5⤵
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
      4⤵
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58962.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
      4⤵
      PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        6⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10205.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        5⤵
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36464.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52219.exe
      4⤵
      PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52437.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
        5⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16115.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-195.exe
      4⤵
      PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
      4⤵
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
      4⤵
      PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37476.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53309.exe
      4⤵
      PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
      4⤵
      PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63749.exe
      4⤵
      PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44850.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39006.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        8⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
        8⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        7⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30149.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57712.exe
        7⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
        7⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        8⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
        8⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        8⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        7⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21077.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20707.exe
        6⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32674.exe
        7⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61570.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35582.exe
        7⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
        8⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        8⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10961.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        7⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
        6⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        7⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        7⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50059.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
        5⤵
        Executes dropped EXE
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39468.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        6⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28732.exe
        5⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        5⤵
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60989.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        7⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        7⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39940.exe
        6⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12830.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
        5⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61669.exe
        6⤵
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        5⤵
        
        PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36485.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        6⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23024.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        5⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
        6⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13315.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        5⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
      4⤵
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51918.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        5⤵
        
        PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
      4⤵
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47113.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32408.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-202.exe
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
      4⤵
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        6⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16863.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        6⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        6⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
        5⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23883.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23927.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46411.exe
        5⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exe
        5⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2717.exe
        6⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40083.exe
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        6⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        5⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        6⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40543.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        5⤵
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
      4⤵
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51726.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25292.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10961.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52421.exe
      4⤵
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21275.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13308.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
      4⤵
      PID:6588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20061.exe
        5⤵
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16115.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61456.exe
      4⤵
      PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58865.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
      4⤵
      PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
      4⤵
      PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        5⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53614.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53750.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
      4⤵
      PID:6412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63024.exe
    3⤵
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19433.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
      4⤵
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36369.exe
    3⤵
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32408.exe
    3⤵
    PID:4064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
    3⤵
    PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
    3⤵
    PID:6620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61278.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61278.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-200.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13542.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        6⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39006.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        6⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        5⤵
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        5⤵
        
        PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6914.exe
      4⤵
      PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
      4⤵
      PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
      4⤵
      PID:5500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24283.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8710.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exe
      4⤵
      PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45255.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
      4⤵
      PID:5784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19075.exe
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
      4⤵
      PID:6428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
    3⤵
    PID:5944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
    3⤵
    PID:6316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59327.exe
    3⤵
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
      4⤵
      PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59665.exe
      4⤵
      PID:6600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37154.exe
    3⤵
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27798.exe
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47926.exe
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
    3⤵
    PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
    3⤵
    PID:6420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
      4⤵
      PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29546.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5617.exe
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
      4⤵
      PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37874.exe
      4⤵
      PID:6876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20615.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe
    3⤵
    PID:3496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
    3⤵
    PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
    3⤵
    PID:6800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59806.exe
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64632.exe
    3⤵
    PID:3660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
    3⤵
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
    3⤵
    PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
    3⤵
    PID:6460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
  2⤵
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40669.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40669.exe
  2⤵
  PID:3448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32096.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32096.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
  2⤵
  PID:5660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48688.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48688.exe
  2⤵
  PID:5788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10833.exe

Filesize
468KB

MD5
88e15d57ac84fb3563d6591c4e3e31e9

SHA1
d52a6fa39c278d63d9baa6d34cea3503829ad8b2

SHA256
51775f4703b9fd9e8e7ed0281528c090e8f68d08770272bf1863fa2e9eaa9d43

SHA512
0f9cc0e12399346e2f9a7e308e76dc5352ff0af91be45be8fcada38163e713e3a5cec2111e23338c21b5f00b9b4b042f92833c5f026a982e253a6369244b0708

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33257.exe

Filesize
468KB

MD5
dfb25d586629ba4500d87d8c6dc64888

SHA1
768a9c4785f07cba6bd273509116612adb7a78cc

SHA256
8306a39893795aae7f5d376302660a3965a23ea99214f7e3b2a00cd463850a3e

SHA512
8da3a0b570677521a0fa6cebe5754e48e3baa129610defc3f1097e1feb894ee4f92d2ae045e55ff0090550e9a618824a5223bf007d9cc6b9cff8b6b4bc169cc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe

Filesize
468KB

MD5
aa6ac6cfe3030411f9dd7cc275a38bd2

SHA1
06b5cef821778b60aed1544029677cb166a9bd7a

SHA256
aaa48d292f87f08032e90441cfac5f5552ce37ad959f00db0b2049694990b223

SHA512
47053192a21fe2152464288b1b3fac7ce245e6a859f13de7ddd8113f57f7ba4854ce26a004c5c9a8920d5fa9a7b48930e6d82c9f2ef617c6a0193ccafe9d7b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe

Filesize
468KB

MD5
2b87ede740de5a30a887b5157698d652

SHA1
671150a7d61253aabc41d09d1c3bc0994c508820

SHA256
e1c57937488610c3a65b3d969d674e11060c80f5388102eba6a561851c003369

SHA512
6c4b3441a988a590491c8b1c9eb5498159595d6c1a8053ed1ea099b3626ebbbc493b69a8f318b83edf56c4e4feed97795150cb81f1e7a740235e207c038eb756

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe

Filesize
468KB

MD5
1f3587273fb2a6693dade47e062cd0ca

SHA1
e9c1c288a746c1af43522927aa16aa4e53d895d6

SHA256
a44b0d7ad72abb310104386398f318cd0d1fc15793423127f09077bac04046e5

SHA512
1884a4d18c28dfdc6d3f808db99b4a9bb99d503139d5bb6667a2d1c653fa7bb15330c79875ddb1d9498af1e2317e7ab2ce6783c8a97366c06b628c75f9ec12af

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe

Filesize
468KB

MD5
99469b9948c4d311b5c02cab18606e4e

SHA1
94826256f6e2c8e3893face4df1be7b869ee769f

SHA256
1518d6681ef520000881653085573440c835b83be11258af5e3188950dd84bce

SHA512
c4e9988333633934dd4bc7b5b97705fd0aac260e386fa4e5835b00f002583480750f0160c1d025e89b649d9b1678e9a3266da840a77d4a0c2bdbb127ccecd982

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1871.exe

Filesize
468KB

MD5
418cc302993376be05b272139d11779e

SHA1
e18d471f7e23946066d5f7b87e27fa16c2dff152

SHA256
f4da4b876861cfeb92a4f39ab7bdd78418361400a18ee7a8b027b7f88868aaa4

SHA512
3c8fb34852666770187ee3812b684fb2a0491766466a75cf30cae3f61e427dd309216fa34a81f7c170a61a92bc0e8a135878b6df2be24e8033ec8991486461e7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-200.exe

Filesize
468KB

MD5
5a3db1f6fe3fb7f26c2479f84b948d6f

SHA1
c0bd9db1692e467f1cd9888ead41bd3747737f2c

SHA256
c5b1ab662e5a70f76ce7a900d9043d34e19c66eee6ba6e46d603ef54fee4f9f5

SHA512
dedf1b197fd4e4ae8121f270d0b4d8e1d0e95d625382152ec8f6485335aa84077f6aeca3a19539a807c85394d184a7c0369a81419d65ebc4def21269cccefa17

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2426.exe

Filesize
468KB

MD5
2c0bf032b1d9c372615e1272f5464b50

SHA1
ec21f146740d801174eb953bdea04642094df1f6

SHA256
dbd2d5139fb78bf2cda9b4c4e5c12c7298b90358c26a88009fb41d1f4d8a7cdc

SHA512
cb9b1782b0c0ce2ad6364760c86a7547fbf98ae73b90735172719d3c53829a1b0ef15b35df433009a54edf2049846203ec9f473acc143eb920151e783c92c18a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe

Filesize
468KB

MD5
1479e4b82528c3c179c68de72730cf41

SHA1
3c33ce3107146d34ed5f789f63bfe2995eee7fba

SHA256
6d8d0644aa4882ce8b76b77183be97041d970cbd52d10c8b30c6a21b344e94da

SHA512
8201ce9828d7413140cf9a55b6d22211940c1006ff92cb6288b13492adf29618dfc1764cff7c0a06efda5f36fc1ed76c1860c83ec8011d1e3d179348117e589e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe

Filesize
468KB

MD5
eb3bf94aec4a0fd4f88cff9222fdb0a7

SHA1
162f70f333be8cf14123ad6a9ec768c3e1d9e580

SHA256
b19fd1be1cad07307177882fc61c24eba32e87479a17ba76471b3b424bc6c1f3

SHA512
d2f6e54d49de27dd763010ca445b61f1c42b72e00607f4bc996e39dbdb7085c34b4c2d0f5671a773f200082976d7e742a1b79f107aea444ee16e1601161c6476

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41669.exe

Filesize
468KB

MD5
9ccb172c2739f40e0dae8db8c40541ad

SHA1
8b0a1b4ba3311393fc830087db1be378ba095d0a

SHA256
0fdb8723397b14f17b09f8238990f3364ccabdb65e547d0b2a9f02fc61008026

SHA512
ec7527de79b3ce89582e3095c8bb6507636cb538ba5b6f43f7236569102b938206e7fadeeb0cdc5f4cd627324c1939a33950fdd2b0f32aa83971f31e156a254c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44850.exe

Filesize
468KB

MD5
8e150d9e773ebe693a8dd101e91f1208

SHA1
a7a22ce7433f2a61ef17e3fbf5f3519b38e92c46

SHA256
c2f0152d9cc7a3f754d4529134375601aa61e272e0c1427706371e95d9d99c63

SHA512
c8180cbbad109057e68f88d2ba79f6a5fb7b77771c358fd190e551e96473d861dbb0c6150922f09eda20c8133a81043c87aa70f9c159d39d6ae1c325f4d38d79

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe

Filesize
468KB

MD5
2efd88e38f05abd75db3994e15046808

SHA1
d488d65fc9067fefef29c53e4ab10ecd7fbac1eb

SHA256
5c34647cd07933841af7d4941037e8beac0e5006cc709082c9778740b0fc0e7f

SHA512
214e93e9e40e1d33a272f05f81c8ee7a6c6b91e56d8662f05d472b9a8918da355ebcb12a3b7cd682f8d860d5c7e63624574201eb15ce8db786dc63b09c8f95b5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe

Filesize
468KB

MD5
56fc4b83a249ce481395d784ebdedb67

SHA1
b3a64f638159345939bde182512a34507c2b94ab

SHA256
0dc8255aa64f0a43ba1a090f7cb0865857c75c5d855be7d46e90e0b23e496b5d

SHA512
e3e6d858b7669f660d60a714f121a9adb40552007712d54d186f26613dca4345c89ef4b17a76018bd21ee2f99bd2916963fb9017854438c653941587527a5ca8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe

Filesize
468KB

MD5
60766e8411726b05f8d94e85a1aaad68

SHA1
abd47d4f5aadd378b70a3d5e55dbd17d63c16bf7

SHA256
8bbba18a02cd650b13e9c9c71891eed6fef8ab7f2c5b825f68707d8cc5392bd1

SHA512
bc78d9ccf5b1d5af3bc644239950811f064ef37e61bb1e1cfb74cdd77ffdb2e906d0376eb0102ca12c3fd9ddda107a24c23f705ac73d8f9abcb4eea630cfe629

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61278.exe

Filesize
468KB

MD5
9b269cae5ea08d5739e431498540b4ad

SHA1
c6aa00027587d8379c2a09a359fcfbff917b604e

SHA256
4cfa5497d5cd76306fcf31ae2af7e9e54196c5e14ef8ab458961d0d921fb28a0

SHA512
0b2fec0cdee9f710d934f296ab6ca92e643ce1100ae5c83c79e00299620c0ad3c575ce7ecbcfc619edc9853c88b0c5695c4f1926969f6cb35ed8811ab05bb755

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe

Filesize
468KB

MD5
f50244cd968473cd32a5e0de0890a55b

SHA1
75eee26b77c58269828d1b611fd8edd4f397ead5

SHA256
db791965b446ef5ffc88599eea6ff54669f8ab300724968df5ba79ee3c9a70b8

SHA512
10e5b873a156449afda7603c7afad78bf7b5a70cc46353989a06ddf1804ca2faf78f0ded5c7175bc1713250a3fa2cfb710c4aff68e1b3596a9b9207e61e8b6dd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe

Filesize
468KB

MD5
d99b65365cff3d77e7bbd86e07fe40d4

SHA1
60e93a12ae97c37c4d7cdf3d4e7fc8dfb03edd99

SHA256
83883ef9447caf77d3117430c2435ff3ca4ee2d6df03b006b043c7c6d891c661

SHA512
f686763b8ba956ff86a698c83ae65a329901cc4b6ae6f3e31a057c24465a85251955216c4642718b4974f9ae011bed76a31304ae0deac20e1c5fee584659df2f

Download Submit
memory/112-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/236-353-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/236-363-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/544-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/956-382-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/956-383-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/956-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1108-401-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1108-403-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1108-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1240-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1248-217-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1248-392-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1248-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1248-391-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1248-224-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1288-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1396-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-262-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/1444-263-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/1572-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-283-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1604-282-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1608-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1612-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1612-327-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1612-328-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1616-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-24-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/1628-320-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/1628-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-167-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/1628-10-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/1632-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-415-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1632-417-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1668-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-428-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2040-244-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2040-240-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2040-429-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2040-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-235-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2152-416-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2152-237-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2152-43-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2152-51-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2152-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-418-0x0000000001EF0000-0x0000000001F65000-memory.dmp

Filesize
468KB

Download
memory/2328-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-168-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2336-174-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2336-301-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2336-299-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2432-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2676-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-209-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2756-208-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2756-90-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2808-251-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/2808-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-129-0x00000000033E0000-0x0000000003455000-memory.dmp

Filesize
468KB

Download
memory/2808-252-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/2808-128-0x00000000033E0000-0x0000000003455000-memory.dmp

Filesize
468KB

Download
memory/2812-112-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2812-273-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/2812-274-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/2812-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-176-0x0000000001FC0000-0x0000000002035000-memory.dmp

Filesize
468KB

Download
memory/2844-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-302-0x0000000001FC0000-0x0000000002035000-memory.dmp

Filesize
468KB

Download
memory/2844-169-0x0000000001FC0000-0x0000000002035000-memory.dmp

Filesize
468KB

Download
memory/2880-360-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2880-351-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2880-195-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2880-196-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2908-173-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2908-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-171-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2908-318-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2908-319-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2984-343-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/2984-344-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2984-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download