6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
Size

468KB
MD5

fea4d993a181ced3ea0a9f05230bfc10
SHA1

a9625132d9a1861bbf69b218ef1d3880b4ea1bd1
SHA256

6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53
SHA512

984fd9e2011ec02d97853237d2340c6c2cca43b36008265f470ec9e8728e7c0ceca626bc905ad9f33fdbf922f4a6accfbb5c869a3a05206563a9ee040e56b713
SSDEEP

3072:1+ACoZIdj05UtbYJP0Njff8/ECYFtIpCn9HexVp+QAb3gYOKRGlO:1+1oc8UtOPojffh0BoQADVOKR

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2008	Unicorn-15218.exe
1708	Unicorn-10423.exe
1944	Unicorn-52011.exe
572	Unicorn-42157.exe
764	Unicorn-42157.exe
2780	Unicorn-27858.exe
2776	Unicorn-14123.exe
2824	Unicorn-58851.exe
2752	Unicorn-55130.exe
2604	Unicorn-62743.exe
2316	Unicorn-50491.exe
2924	Unicorn-35042.exe
2636	Unicorn-11357.exe
2120	Unicorn-44361.exe
2884	Unicorn-35307.exe
1224	Unicorn-58140.exe
2988	Unicorn-25638.exe
2100	Unicorn-12831.exe
1648	Unicorn-16213.exe
1096	Unicorn-26236.exe
1076	Unicorn-59655.exe
1940	Unicorn-13983.exe
1632	Unicorn-13983.exe
600	Unicorn-54632.exe
1288	Unicorn-50283.exe
548	Unicorn-41618.exe
2220	Unicorn-46464.exe
1588	Unicorn-42380.exe
1760	Unicorn-14346.exe
2064	Unicorn-7661.exe
2656	Unicorn-47211.exe
3016	Unicorn-44757.exe
2508	Unicorn-61840.exe
1028	Unicorn-8000.exe
2284	Unicorn-37933.exe
1236	Unicorn-31802.exe
2368	Unicorn-1731.exe
2188	Unicorn-1176.exe
2996	Unicorn-57896.exe
1904	Unicorn-21405.exe
2400	Unicorn-38103.exe
2812	Unicorn-50870.exe
2852	Unicorn-51233.exe
2860	Unicorn-49609.exe
1900	Unicorn-22644.exe
684	Unicorn-26174.exe
2640	Unicorn-38426.exe
2664	Unicorn-10724.exe
2896	Unicorn-58144.exe
2560	Unicorn-64274.exe
1692	Unicorn-23434.exe
1952	Unicorn-63505.exe
1384	Unicorn-47746.exe
2504	Unicorn-41616.exe
1048	Unicorn-35494.exe
2980	Unicorn-60361.exe
1608	Unicorn-14689.exe
2280	Unicorn-15436.exe
1468	Unicorn-11352.exe
2480	Unicorn-14497.exe
1260	Unicorn-14497.exe
1856	Unicorn-37148.exe
1684	Unicorn-18011.exe
1680	Unicorn-39962.exe

Loads dropped DLL 64 IoCs

pid	Process
2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
2008	Unicorn-15218.exe
2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
2008	Unicorn-15218.exe
2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
1944	Unicorn-52011.exe
1708	Unicorn-10423.exe
1708	Unicorn-10423.exe
1944	Unicorn-52011.exe
2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
2008	Unicorn-15218.exe
2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
2008	Unicorn-15218.exe
764	Unicorn-42157.exe
764	Unicorn-42157.exe
1944	Unicorn-52011.exe
1944	Unicorn-52011.exe
2776	Unicorn-14123.exe
2776	Unicorn-14123.exe
2008	Unicorn-15218.exe
2780	Unicorn-27858.exe
1708	Unicorn-10423.exe
2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
572	Unicorn-42157.exe
2780	Unicorn-27858.exe
1708	Unicorn-10423.exe
2008	Unicorn-15218.exe
2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
572	Unicorn-42157.exe
2824	Unicorn-58851.exe
2824	Unicorn-58851.exe
764	Unicorn-42157.exe
764	Unicorn-42157.exe
2752	Unicorn-55130.exe
2752	Unicorn-55130.exe
1944	Unicorn-52011.exe
1944	Unicorn-52011.exe
2316	Unicorn-50491.exe
2316	Unicorn-50491.exe
2780	Unicorn-27858.exe
2780	Unicorn-27858.exe
2120	Unicorn-44361.exe
2924	Unicorn-35042.exe
2924	Unicorn-35042.exe
2120	Unicorn-44361.exe
2884	Unicorn-35307.exe
2884	Unicorn-35307.exe
2008	Unicorn-15218.exe
2008	Unicorn-15218.exe
2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
2636	Unicorn-11357.exe
2636	Unicorn-11357.exe
2604	Unicorn-62743.exe
2604	Unicorn-62743.exe
572	Unicorn-42157.exe
572	Unicorn-42157.exe
1708	Unicorn-10423.exe
1708	Unicorn-10423.exe
2776	Unicorn-14123.exe
2776	Unicorn-14123.exe
1224	Unicorn-58140.exe
1224	Unicorn-58140.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2864	2664	WerFault.exe	78
2488	2856	WerFault.exe	108

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14346.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
2008	Unicorn-15218.exe
1708	Unicorn-10423.exe
1944	Unicorn-52011.exe
764	Unicorn-42157.exe
2776	Unicorn-14123.exe
2780	Unicorn-27858.exe
572	Unicorn-42157.exe
2824	Unicorn-58851.exe
2752	Unicorn-55130.exe
2604	Unicorn-62743.exe
2316	Unicorn-50491.exe
2120	Unicorn-44361.exe
2924	Unicorn-35042.exe
2636	Unicorn-11357.exe
2884	Unicorn-35307.exe
1224	Unicorn-58140.exe
2988	Unicorn-25638.exe
2100	Unicorn-12831.exe
1648	Unicorn-16213.exe
1096	Unicorn-26236.exe
1632	Unicorn-13983.exe
1076	Unicorn-59655.exe
1940	Unicorn-13983.exe
1288	Unicorn-50283.exe
600	Unicorn-54632.exe
548	Unicorn-41618.exe
2220	Unicorn-46464.exe
1588	Unicorn-42380.exe
1760	Unicorn-14346.exe
2064	Unicorn-7661.exe
2656	Unicorn-47211.exe
3016	Unicorn-44757.exe
2508	Unicorn-61840.exe
1028	Unicorn-8000.exe
1236	Unicorn-31802.exe
2368	Unicorn-1731.exe
2284	Unicorn-37933.exe
2188	Unicorn-1176.exe
2996	Unicorn-57896.exe
1904	Unicorn-21405.exe
2400	Unicorn-38103.exe
2812	Unicorn-50870.exe
2852	Unicorn-51233.exe
2860	Unicorn-49609.exe
684	Unicorn-26174.exe
1900	Unicorn-22644.exe
2640	Unicorn-38426.exe
2664	Unicorn-10724.exe
2560	Unicorn-64274.exe
1692	Unicorn-23434.exe
2896	Unicorn-58144.exe
1952	Unicorn-63505.exe
2504	Unicorn-41616.exe
1384	Unicorn-47746.exe
2980	Unicorn-60361.exe
1048	Unicorn-35494.exe
1608	Unicorn-14689.exe
1468	Unicorn-11352.exe
2280	Unicorn-15436.exe
1260	Unicorn-14497.exe
2480	Unicorn-14497.exe
1856	Unicorn-37148.exe
1684	Unicorn-18011.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2008	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	31
PID 2304 wrote to memory of 2008	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	31
PID 2304 wrote to memory of 2008	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	31
PID 2304 wrote to memory of 2008	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	31
PID 2008 wrote to memory of 1708	2008	Unicorn-15218.exe	32
PID 2008 wrote to memory of 1708	2008	Unicorn-15218.exe	32
PID 2008 wrote to memory of 1708	2008	Unicorn-15218.exe	32
PID 2008 wrote to memory of 1708	2008	Unicorn-15218.exe	32
PID 2304 wrote to memory of 1944	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	33
PID 2304 wrote to memory of 1944	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	33
PID 2304 wrote to memory of 1944	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	33
PID 2304 wrote to memory of 1944	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	33
PID 1708 wrote to memory of 572	1708	Unicorn-10423.exe	35
PID 1708 wrote to memory of 572	1708	Unicorn-10423.exe	35
PID 1708 wrote to memory of 572	1708	Unicorn-10423.exe	35
PID 1708 wrote to memory of 572	1708	Unicorn-10423.exe	35
PID 1944 wrote to memory of 764	1944	Unicorn-52011.exe	34
PID 1944 wrote to memory of 764	1944	Unicorn-52011.exe	34
PID 1944 wrote to memory of 764	1944	Unicorn-52011.exe	34
PID 1944 wrote to memory of 764	1944	Unicorn-52011.exe	34
PID 2304 wrote to memory of 2780	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	36
PID 2304 wrote to memory of 2780	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	36
PID 2304 wrote to memory of 2780	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	36
PID 2304 wrote to memory of 2780	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	36
PID 2008 wrote to memory of 2776	2008	Unicorn-15218.exe	37
PID 2008 wrote to memory of 2776	2008	Unicorn-15218.exe	37
PID 2008 wrote to memory of 2776	2008	Unicorn-15218.exe	37
PID 2008 wrote to memory of 2776	2008	Unicorn-15218.exe	37
PID 764 wrote to memory of 2824	764	Unicorn-42157.exe	38
PID 764 wrote to memory of 2824	764	Unicorn-42157.exe	38
PID 764 wrote to memory of 2824	764	Unicorn-42157.exe	38
PID 764 wrote to memory of 2824	764	Unicorn-42157.exe	38
PID 1944 wrote to memory of 2752	1944	Unicorn-52011.exe	39
PID 1944 wrote to memory of 2752	1944	Unicorn-52011.exe	39
PID 1944 wrote to memory of 2752	1944	Unicorn-52011.exe	39
PID 1944 wrote to memory of 2752	1944	Unicorn-52011.exe	39
PID 2776 wrote to memory of 2604	2776	Unicorn-14123.exe	40
PID 2776 wrote to memory of 2604	2776	Unicorn-14123.exe	40
PID 2776 wrote to memory of 2604	2776	Unicorn-14123.exe	40
PID 2776 wrote to memory of 2604	2776	Unicorn-14123.exe	40
PID 2780 wrote to memory of 2316	2780	Unicorn-27858.exe	42
PID 2780 wrote to memory of 2316	2780	Unicorn-27858.exe	42
PID 2780 wrote to memory of 2316	2780	Unicorn-27858.exe	42
PID 2780 wrote to memory of 2316	2780	Unicorn-27858.exe	42
PID 1708 wrote to memory of 2636	1708	Unicorn-10423.exe	43
PID 1708 wrote to memory of 2636	1708	Unicorn-10423.exe	43
PID 1708 wrote to memory of 2636	1708	Unicorn-10423.exe	43
PID 1708 wrote to memory of 2636	1708	Unicorn-10423.exe	43
PID 2008 wrote to memory of 2120	2008	Unicorn-15218.exe	41
PID 2008 wrote to memory of 2120	2008	Unicorn-15218.exe	41
PID 2008 wrote to memory of 2120	2008	Unicorn-15218.exe	41
PID 2008 wrote to memory of 2120	2008	Unicorn-15218.exe	41
PID 2304 wrote to memory of 2924	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	44
PID 2304 wrote to memory of 2924	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	44
PID 2304 wrote to memory of 2924	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	44
PID 2304 wrote to memory of 2924	2304	6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe	44
PID 572 wrote to memory of 2884	572	Unicorn-42157.exe	45
PID 572 wrote to memory of 2884	572	Unicorn-42157.exe	45
PID 572 wrote to memory of 2884	572	Unicorn-42157.exe	45
PID 572 wrote to memory of 2884	572	Unicorn-42157.exe	45
PID 2824 wrote to memory of 1224	2824	Unicorn-58851.exe	46
PID 2824 wrote to memory of 1224	2824	Unicorn-58851.exe	46
PID 2824 wrote to memory of 1224	2824	Unicorn-58851.exe	46
PID 2824 wrote to memory of 1224	2824	Unicorn-58851.exe	46

C:\Users\Admin\AppData\Local\Temp\6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe
"C:\Users\Admin\AppData\Local\Temp\6a409095be7cf9addf195d192c16cd9dc6a8560e2f4edcd2bec2386d37c81f53N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15218.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15218.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10423.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42157.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14689.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
        8⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        8⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
        8⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        8⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
        7⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8199.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40460.exe
        7⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
        7⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47981.exe
        8⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        7⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        6⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65011.exe
        7⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        7⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29334.exe
        6⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        7⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exe
        8⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
        7⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        7⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        7⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        7⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
        7⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
        6⤵
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
        6⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25605.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        5⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48409.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3668.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11357.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35494.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        7⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7495.exe
        8⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59796.exe
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        7⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
        6⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12632.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
        7⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        6⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37902.exe
        7⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32683.exe
        7⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
        6⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        6⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
        5⤵
        
        PID:676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        5⤵
        
        PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17124.exe
        6⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64824.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17183.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2664
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 240
        5⤵
        Program crash
        
        PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37850.exe
      4⤵
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
      4⤵
      PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54507.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62743.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        7⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2440.exe
        8⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        8⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10815.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        7⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        7⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
        6⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        7⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59229.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
        6⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7495.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59796.exe
        7⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14670.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        6⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54070.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
        5⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1969.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        5⤵
        
        PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47211.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        6⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe
        6⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
        5⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7230.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41616.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35743.exe
        5⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        5⤵
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exe
      4⤵
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25448.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27796.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33207.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
      4⤵
      PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31404.exe
      4⤵
      PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        6⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54819.exe
        5⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22644.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5940.exe
        5⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        5⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24210.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        5⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23604.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        6⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28124.exe
        5⤵
        
        PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
      4⤵
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
        5⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18011.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
      4⤵
      PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
      4⤵
      PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
    3⤵
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5929.exe
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
    3⤵
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
    3⤵
    PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
    3⤵
    PID:6376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42157.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58851.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        7⤵
        Executes dropped EXE
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3579.exe
        8⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        8⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        8⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        7⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37776.exe
        6⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12632.exe
        7⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2269.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        6⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45109.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        7⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        8⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        8⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11318.exe
        7⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54819.exe
        6⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46950.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        7⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9265.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28573.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23608.exe
        5⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        7⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28998.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21943.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        6⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57520.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8000.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exe
        6⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
        7⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        7⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        6⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40460.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34569.exe
        5⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        5⤵
        
        PID:296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57017.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
        5⤵
        
        PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31802.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe
        5⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        6⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3359.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        5⤵
        
        PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65036.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21113.exe
      4⤵
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        5⤵
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47223.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
      4⤵
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55130.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        6⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        7⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        6⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
        6⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        5⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        5⤵
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23599.exe
        5⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        6⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
      4⤵
      PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
      4⤵
      PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3579.exe
        6⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3359.exe
        6⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42353.exe
      4⤵
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
        5⤵
        
        PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41085.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
        5⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        5⤵
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
      4⤵
      PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
      4⤵
      PID:7040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57896.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
      4⤵
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63031.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
      4⤵
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
      4⤵
      PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
      4⤵
      PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
    3⤵
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35733.exe
      4⤵
      PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
      4⤵
      PID:6192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11261.exe
    3⤵
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
    3⤵
    PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36780.exe
    3⤵
    PID:6384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27858.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27858.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe
        6⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60188.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63498.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        7⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        7⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        6⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        5⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38855.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26032.exe
        5⤵
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19729.exe
        5⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6695.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exe
      4⤵
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64308.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
      4⤵
      PID:6148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26174.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
        5⤵
        
        PID:2856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 244
        6⤵
        Program crash
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
        5⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36811.exe
        6⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        5⤵
        
        PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
      4⤵
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52970.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        5⤵
        
        PID:584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
      4⤵
      PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
      4⤵
      PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
      4⤵
      PID:7048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58144.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
      4⤵
      PID:304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
      4⤵
      PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
      4⤵
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51809.exe
    3⤵
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20246.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
      4⤵
      PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47566.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7668.exe
    3⤵
    PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35995.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        5⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        6⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        5⤵
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
      4⤵
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        5⤵
        
        PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
      4⤵
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22655.exe
      4⤵
      PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51233.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
      4⤵
      PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3359.exe
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
      4⤵
      PID:6500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
    3⤵
    PID:2984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
    3⤵
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64102.exe
    3⤵
    PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
    3⤵
    PID:6416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64274.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6189.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe
      4⤵
      PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
    3⤵
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16148.exe
    3⤵
    PID:5860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
    3⤵
    PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
    3⤵
    PID:6612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
  2⤵
  PID:944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
  2⤵
  PID:3124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17346.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17346.exe
  2⤵
  PID:4588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51416.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51416.exe
  2⤵
  PID:5404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60409.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60409.exe
  2⤵
  PID:6544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe

Filesize
468KB

MD5
cddd6049a3666fa55a206bc93c1798bc

SHA1
7a90980a4f57930fb0bd52c67daeae203fa02dfc

SHA256
62cebe5ed3789328db1e8dbf0a1f6fb7ffed5c7a38ab083129081ce5b5cd4ef2

SHA512
7b8e5bd4c6c90a97ed04f25acc70f49939d2b0f5aae54d64c71644a6060bb7ee231bc1f2360e818533cdcb10ab69a79018cce2a8e770f1aadab38ff18249125b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe

Filesize
468KB

MD5
0faf7b35bf24b14119cca43aebd08d59

SHA1
eb13b5654f0d014d85e905cedc18bc2df15255ff

SHA256
96eee3f5325fe6560c24086b5ae4f49cb6adbcfe67647786afc791951c1580dd

SHA512
240e81159ca56e81692e3d4214976c18b7942bcafb47a6dbd3d4cafb4233a8f9635d2dc191c416c812fadc7bea1cb70a9356530d74798b85cd8c89546675a3ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51416.exe

Filesize
468KB

MD5
d01af9177ae7cbc50d5990104ea16e14

SHA1
cf52d754eaeab549dc3502a91974eeb678dae60a

SHA256
9a21d0e53ee6c077b601d230b8bdb3de5a0c3ac6afe6f8f7446674d266b7e261

SHA512
e715e91cd7f7bef17188d1626077bba2a363e0111438044931f007c9594922d724b441f8e652445d29fd0951164f5eb6f7c75df5c512c946502e883c943ba1fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe

Filesize
468KB

MD5
2d6b2839de511b94528c0ccd8d00e35d

SHA1
248589548744832a8ceb92ae94b6239e62209490

SHA256
f38b0ca2ac161e8561c0fd1d4f37bbacf5417e772448f425f08f8399e80c1ee3

SHA512
3783c42c58a15d2ace16eb52b348c355ac86651666b3d1880e8226ceaef83e698d82e4fbe922eff8e8f6a424fd054443553cef5baedf0af933c43261a391c535

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54070.exe

Filesize
468KB

MD5
c97298328da4eac481a0018228d18a2c

SHA1
59d0d337f8652648c680a81792d0b29a72b16148

SHA256
44c100e27b03674592446635e967e3382386b77b02b4707afb78e19dfffdc1d1

SHA512
b726d070c9b402d81237c8658a9718fe3aa2ff432fd8e2040826da12b8cbcb4a7d7d080453105ee9c8d10316efb31a5b861a5f1fb55753ba078f21c8095b769d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5940.exe

Filesize
468KB

MD5
265cbcc2d71fe7ba0477be3ca3eacaf2

SHA1
14d37f7e3582a568583f70bd13a09e959d8915ce

SHA256
6d59b80c5d10c6c6033aef40c1c11fb07e2b55f3e5b93f96a282213f3f4434e7

SHA512
e013b1441312d3c4542ca53f74fe5c4491022e338e942c812789b4fb2da20f0746f0c787ddd8367e55f2187a694c2766c481e972dd8b8d8e82c18c0ae165a465

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10423.exe

Filesize
468KB

MD5
49c3c659ddeb2bbbcb018d5e3693efff

SHA1
2dd0afb071cedd6f1c601143534e85c3f328b708

SHA256
664c834c5bab10776f827b3507656d2d102b6a8912b374d8f06ebfbbfe9cc6e2

SHA512
ca13254b369945a38ed0b038030cc7f0ba02347c8c671415134b326ce0b85553a48b988b3eaea5bab28966763cf2a2551a700ce5265f808503d22efff1b0e109

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11357.exe

Filesize
468KB

MD5
fdf4879d49428c36d2f5bc2d3e9765fd

SHA1
4ee80265e191cf637a755f38357016a0db92777f

SHA256
cfdfbce12f6ad556e42d6f5fcb564cbfda5fd3088957710b2d045851d8931e9b

SHA512
c85e4042b820ae8e8803df4244a21f5c3e55b713d27126419011d1957abfd4d988dce73e8b800b73cfeadcbc9ece7253f4dfecfd78aa4915fd68dac72a5143e5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe

Filesize
468KB

MD5
88d68187a70c624f498ed0647502dd9b

SHA1
109836d285ed6ebd7a2a9f58ed7b58c87d4841cf

SHA256
569216f0bcbec25949a81f627d89f3198bf8c7f9688c7a73fe476182c22bdb81

SHA512
1eac4db3ab04eb530dce28f01fbe2cf250daecc268515aec2eb2b1d5f5ba6833d791dad79044963a3b9bdcad08e502de89eb3777da7978e70fbd6b3a0638a84d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15218.exe

Filesize
468KB

MD5
d085d7df8a170577313b206b9f864814

SHA1
2817f5e0d49d213a0a607a6f119132ffb33f59a9

SHA256
227da344d257a420a6fb90c877b1839a488b713c31cb908b09279f7c8c0c7ced

SHA512
6d9bb6d660f991c928a49fb3836f732778dec6b670c1ac93128ec63dd5bce1996f1d5c316dfb81e2bf872641ef91237cf6df5cd44fd2efd9c15649b8d9f41312

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe

Filesize
468KB

MD5
21cf7fc3079b539f40228777e89ee24c

SHA1
3474369a6ba002f2cf307ba9905dec1d92f7e3b6

SHA256
071c14b6ceaf7181ab94ba92b80e99d7a9b18cbc4ab47de041a1d1148becb92f

SHA512
e2a107a75a50aa6c7eadc3ba2409790e78ebe614a844e8b4ee90a2aa5b6d1d21cb20ee8c0e7fe2d330688d46628ce224ccdd4971cc9e05536d323097eae5615a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe

Filesize
468KB

MD5
cfe5924a8887ae53f0c2b37230468fdf

SHA1
1c9430dde3946d2d54e8fd1fc9ab20a3b9f13c6f

SHA256
202f35b35c683f7b572df2241ef5d5f6ec538315e0266aea05e2972a5ff9df69

SHA512
d40eee0dc366c1895a470f98fcff35605f8909d531acbf56ec57cf5f7636b31a30ea88757506be76027af638080ffb300c385f8a2f5f982edc9986e58511a2a1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27858.exe

Filesize
468KB

MD5
806f823c80af512be6e06e9d6575cb37

SHA1
d29951e8bd9beb66244adcb39c2edf88171a8fbb

SHA256
f0513ac21c7d172dced3079e86caa5ea4e06feeb96b7526369e622d22b222699

SHA512
402da4291ac18f082328ee65b7a0528e8b4946de68f0bda8a83c43b76c774093538bcdb59e3af28fd752fbbf67077353d941365e3704d4b38355ff3cc3315b81

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe

Filesize
468KB

MD5
226ee61e12068e3b08941ef194539195

SHA1
9f110b1f18ae799a8e983c7ce62f2b164a42ca4b

SHA256
9f765fa31395bf76451db47f2c2c3fccce399e53478d167c7bb78622eb32f233

SHA512
6ff35107d3326b704ab13470d3905285314ed6b4c1f0ca9ba2cc32b7499b9023d89cc0bf0e9542d3445b108f0f344c1077fb3072ebecd97f4039b0e49834c5cf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe

Filesize
468KB

MD5
518240c89c3b310d44b6c4b270fb3d72

SHA1
795f9fc46567ced540bc115757d2c7ed48e658c1

SHA256
0c9388ba8ab5670375c6aaf673b9b9b5593dbcf7f920ff7aace762c530fa6009

SHA512
06af9253871e25ce74ab160fc978172ae4918136c60a44158905ec22a1c9a40deb6542fdf866d34ca2955b66f866d09337910e9f326c40d96d8d480cd39abc74

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42157.exe

Filesize
468KB

MD5
07efdd5e42ab0926aca5394811a03b07

SHA1
5a9149750ef4f56d7a48ed81e70aa30da9ef1052

SHA256
193940cd55ec7f1ec9d692f7947752ac51f4c6a02386eeb110a0b617f8242e2e

SHA512
e8a6e42b74fc7054fcff865f72a03c87c159c0b24fdeb87c409c4eaa082b2facc3e45b69ba0e996da284d7109feb564af2b8114bece4cc2bc2a49d9795ae718d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe

Filesize
468KB

MD5
d8e617ad187a6b396ca0cdb263622ac0

SHA1
a5e4e6801a9e009af40c99e5c3859b6e0576ce0e

SHA256
7584f7bdf0cbd0334df76e78d8dfaf4f725197c5fce517aa7b98becf42975932

SHA512
68a00a58682d7f98e0fe268de0e528d7a1113d455356cbecf9916ba5709cfafd63a6ef4add483b7e2c5d158d1c5ef61c2574eab8d753bff54cd38f3db28197f4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe

Filesize
468KB

MD5
7367f6b26f89560647ba337f0448bf56

SHA1
196a24a96fd4dda8c96c43cf397684c1ec74c3a2

SHA256
9b84a46a525088365394d928421460d0276e842621096f5010288ee8673a55d4

SHA512
1e630e66e459d2205bdbb365d83a0a55d3d758c53fabe0f6548c6f3b8214d352299d4e848ebd22eab80f78d0ec9086bc90fce3970aa2f8ac76a91b4890bde364

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55130.exe

Filesize
468KB

MD5
4f177acc04e847c0055566112a8aada6

SHA1
cb4cb224eabe4ba34d0795caf129481dea943e05

SHA256
33bdc5c7442d809c0fc8246bb2790004ccfc55a68d11fb3c39844d16ecf637ce

SHA512
a7a99ddecb9a4b244cfae2bf33bf51836510f9f2fb0f1609136b6ad08812d1a93ca1eebc96858217a14db5414b5c32873e69501a4d62c50db20a818b4d57ba0a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe

Filesize
468KB

MD5
8d514a11fb716a94c86d6e17d00dbb2e

SHA1
49442efbcf08c1966a9567464bef2d9f4e485d6e

SHA256
6e90a95b64d9fee23b701509cc602c26c754d092d599e8ee2e8f08b4ccf53dd8

SHA512
3d1c168747e0a9539c64e6482b8307baf17c68e1a97582adcf1152fec9c2d98f059dcafd122280422bf16c0868d3f0dbeecdc08169c184526038ade4573f4695

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58851.exe

Filesize
468KB

MD5
abdfd04e5239709543814faa8bda6b96

SHA1
0d6f03f8ff3b9483a1c1e7f9f678478555ae40c8

SHA256
4c55b2bfde7a46d0f79c9f8070cdf1cb8cd9ec15984100c614029da19ad5a001

SHA512
309a762aa3831dbd51edc66d632e35c393a0e7a8bbe4afe3df41bcda6e902f1e6ca00b582d17bbbf7ea8a7174abaf852c398d50cbc2322d584f4161fb5891be4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62743.exe

Filesize
468KB

MD5
10bfbbe5802c03f50dee15340b856930

SHA1
0d9f4a2a6a9d161fcbb62678402a41d1359bc1cd

SHA256
5eaa3efcf978dee498a3860353403082e73fc18e3b9c07e960df9c428a02c879

SHA512
2c75953f60cf1e9cf4a9666f2468f952e298dd98266bf69d98b4c7c90ee56de575d8ba1100ae7edf1d4ddaac4dde7ba60abef4a193bc602ecfd16739a32d53a1

Download Submit