08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0f

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
Size

468KB
MD5

2de4f7628b900320a80ecf0b80f74a90
SHA1

2a7db0fd87f1756db794637745832e58a75e88be
SHA256

08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0f
SHA512

69cd0c218ba9186cd0466f99cfe1f106ebbb215cb7e0ffd070cc26ad458bbaa6e06a73e62b2a24b8e1b5dc0e84ca6d9862bb81a76b6a3e48ef1a5e17f66035e6
SSDEEP

3072:6bpOogJER05BtgYtPzDjqf8uECnZRnpRnmHh9oh2e4LcrcmQuHED:6bUoR8BtTPfjqf9pw9e4IgmQu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1288	Unicorn-52971.exe
2740	Unicorn-59037.exe
2844	Unicorn-17450.exe
2708	Unicorn-41700.exe
2824	Unicorn-13666.exe
2796	Unicorn-33532.exe
2728	Unicorn-19425.exe
2968	Unicorn-59655.exe
540	Unicorn-53002.exe
2284	Unicorn-54485.exe
1792	Unicorn-64699.exe
2316	Unicorn-56531.exe
1072	Unicorn-7522.exe
1924	Unicorn-7257.exe
1692	Unicorn-53194.exe
580	Unicorn-28026.exe
2212	Unicorn-61445.exe
1988	Unicorn-45670.exe
1912	Unicorn-37237.exe
832	Unicorn-2992.exe
1620	Unicorn-41979.exe
1648	Unicorn-48109.exe
1716	Unicorn-25834.exe
1344	Unicorn-27881.exe
1752	Unicorn-27881.exe
2256	Unicorn-48856.exe
1852	Unicorn-48856.exe
1524	Unicorn-56469.exe
1536	Unicorn-32162.exe
2004	Unicorn-41093.exe
3016	Unicorn-4891.exe
2408	Unicorn-9764.exe
1776	Unicorn-15201.exe
1968	Unicorn-41560.exe
2952	Unicorn-21694.exe
2052	Unicorn-29500.exe
2456	Unicorn-4419.exe
2276	Unicorn-50091.exe
3032	Unicorn-44498.exe
1440	Unicorn-41176.exe
2700	Unicorn-46199.exe
2748	Unicorn-57704.exe
2692	Unicorn-59411.exe
2716	Unicorn-13739.exe
2868	Unicorn-1487.exe
2248	Unicorn-25919.exe
2984	Unicorn-9847.exe
1112	Unicorn-55519.exe
2084	Unicorn-26738.exe
712	Unicorn-42520.exe
1088	Unicorn-9271.exe
852	Unicorn-3141.exe
1576	Unicorn-46028.exe
1500	Unicorn-46028.exe
1756	Unicorn-41679.exe
2112	Unicorn-41944.exe
2764	Unicorn-48258.exe
2160	Unicorn-34522.exe
328	Unicorn-29884.exe
2744	Unicorn-4418.exe
1100	Unicorn-47927.exe
924	Unicorn-63708.exe
2024	Unicorn-28797.exe
1320	Unicorn-22375.exe

Loads dropped DLL 64 IoCs

pid	Process
2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
1288	Unicorn-52971.exe
2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
1288	Unicorn-52971.exe
2844	Unicorn-17450.exe
2844	Unicorn-17450.exe
1288	Unicorn-52971.exe
1288	Unicorn-52971.exe
2740	Unicorn-59037.exe
2740	Unicorn-59037.exe
2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
2708	Unicorn-41700.exe
2708	Unicorn-41700.exe
2844	Unicorn-17450.exe
2844	Unicorn-17450.exe
2824	Unicorn-13666.exe
1288	Unicorn-52971.exe
1288	Unicorn-52971.exe
2824	Unicorn-13666.exe
2796	Unicorn-33532.exe
2796	Unicorn-33532.exe
2728	Unicorn-19425.exe
2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
2728	Unicorn-19425.exe
2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
2740	Unicorn-59037.exe
2740	Unicorn-59037.exe
2968	Unicorn-59655.exe
2968	Unicorn-59655.exe
2708	Unicorn-41700.exe
2708	Unicorn-41700.exe
2284	Unicorn-54485.exe
1288	Unicorn-52971.exe
2284	Unicorn-54485.exe
1288	Unicorn-52971.exe
540	Unicorn-53002.exe
540	Unicorn-53002.exe
2844	Unicorn-17450.exe
1692	Unicorn-53194.exe
2844	Unicorn-17450.exe
1692	Unicorn-53194.exe
2740	Unicorn-59037.exe
2740	Unicorn-59037.exe
1792	Unicorn-64699.exe
2316	Unicorn-56531.exe
1792	Unicorn-64699.exe
2316	Unicorn-56531.exe
2824	Unicorn-13666.exe
2824	Unicorn-13666.exe
2796	Unicorn-33532.exe
2796	Unicorn-33532.exe
1924	Unicorn-7257.exe
1924	Unicorn-7257.exe
2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
1072	Unicorn-7522.exe
1072	Unicorn-7522.exe
2728	Unicorn-19425.exe
2728	Unicorn-19425.exe
580	Unicorn-28026.exe
580	Unicorn-28026.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2464	2052	WerFault.exe	66
4156	2008	WerFault.exe	123
4336	1040	WerFault.exe	122

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55976.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
1288	Unicorn-52971.exe
2844	Unicorn-17450.exe
2740	Unicorn-59037.exe
2708	Unicorn-41700.exe
2824	Unicorn-13666.exe
2728	Unicorn-19425.exe
2796	Unicorn-33532.exe
2968	Unicorn-59655.exe
2284	Unicorn-54485.exe
540	Unicorn-53002.exe
1924	Unicorn-7257.exe
2316	Unicorn-56531.exe
1692	Unicorn-53194.exe
1072	Unicorn-7522.exe
1792	Unicorn-64699.exe
580	Unicorn-28026.exe
2212	Unicorn-61445.exe
1988	Unicorn-45670.exe
1912	Unicorn-37237.exe
832	Unicorn-2992.exe
1648	Unicorn-48109.exe
1620	Unicorn-41979.exe
1716	Unicorn-25834.exe
1344	Unicorn-27881.exe
1752	Unicorn-27881.exe
2256	Unicorn-48856.exe
1852	Unicorn-48856.exe
1524	Unicorn-56469.exe
2004	Unicorn-41093.exe
1536	Unicorn-32162.exe
3016	Unicorn-4891.exe
2408	Unicorn-9764.exe
1776	Unicorn-15201.exe
1968	Unicorn-41560.exe
2952	Unicorn-21694.exe
2052	Unicorn-29500.exe
3032	Unicorn-44498.exe
2276	Unicorn-50091.exe
2456	Unicorn-4419.exe
1440	Unicorn-41176.exe
2700	Unicorn-46199.exe
2748	Unicorn-57704.exe
2692	Unicorn-59411.exe
2716	Unicorn-13739.exe
2868	Unicorn-1487.exe
2248	Unicorn-25919.exe
1112	Unicorn-55519.exe
2984	Unicorn-9847.exe
2084	Unicorn-26738.exe
712	Unicorn-42520.exe
852	Unicorn-3141.exe
2764	Unicorn-48258.exe
1088	Unicorn-9271.exe
1576	Unicorn-46028.exe
1756	Unicorn-41679.exe
1500	Unicorn-46028.exe
2160	Unicorn-34522.exe
2112	Unicorn-41944.exe
328	Unicorn-29884.exe
2744	Unicorn-4418.exe
1100	Unicorn-47927.exe
924	Unicorn-63708.exe
2024	Unicorn-28797.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1288	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	31
PID 2308 wrote to memory of 1288	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	31
PID 2308 wrote to memory of 1288	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	31
PID 2308 wrote to memory of 1288	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	31
PID 2308 wrote to memory of 2740	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	32
PID 2308 wrote to memory of 2740	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	32
PID 2308 wrote to memory of 2740	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	32
PID 2308 wrote to memory of 2740	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	32
PID 1288 wrote to memory of 2844	1288	Unicorn-52971.exe	33
PID 1288 wrote to memory of 2844	1288	Unicorn-52971.exe	33
PID 1288 wrote to memory of 2844	1288	Unicorn-52971.exe	33
PID 1288 wrote to memory of 2844	1288	Unicorn-52971.exe	33
PID 2844 wrote to memory of 2708	2844	Unicorn-17450.exe	34
PID 2844 wrote to memory of 2708	2844	Unicorn-17450.exe	34
PID 2844 wrote to memory of 2708	2844	Unicorn-17450.exe	34
PID 2844 wrote to memory of 2708	2844	Unicorn-17450.exe	34
PID 1288 wrote to memory of 2824	1288	Unicorn-52971.exe	35
PID 1288 wrote to memory of 2824	1288	Unicorn-52971.exe	35
PID 1288 wrote to memory of 2824	1288	Unicorn-52971.exe	35
PID 1288 wrote to memory of 2824	1288	Unicorn-52971.exe	35
PID 2740 wrote to memory of 2796	2740	Unicorn-59037.exe	36
PID 2740 wrote to memory of 2796	2740	Unicorn-59037.exe	36
PID 2740 wrote to memory of 2796	2740	Unicorn-59037.exe	36
PID 2740 wrote to memory of 2796	2740	Unicorn-59037.exe	36
PID 2308 wrote to memory of 2728	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	37
PID 2308 wrote to memory of 2728	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	37
PID 2308 wrote to memory of 2728	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	37
PID 2308 wrote to memory of 2728	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	37
PID 2708 wrote to memory of 2968	2708	Unicorn-41700.exe	38
PID 2708 wrote to memory of 2968	2708	Unicorn-41700.exe	38
PID 2708 wrote to memory of 2968	2708	Unicorn-41700.exe	38
PID 2708 wrote to memory of 2968	2708	Unicorn-41700.exe	38
PID 2844 wrote to memory of 540	2844	Unicorn-17450.exe	39
PID 2844 wrote to memory of 540	2844	Unicorn-17450.exe	39
PID 2844 wrote to memory of 540	2844	Unicorn-17450.exe	39
PID 2844 wrote to memory of 540	2844	Unicorn-17450.exe	39
PID 1288 wrote to memory of 2284	1288	Unicorn-52971.exe	41
PID 1288 wrote to memory of 2284	1288	Unicorn-52971.exe	41
PID 1288 wrote to memory of 2284	1288	Unicorn-52971.exe	41
PID 1288 wrote to memory of 2284	1288	Unicorn-52971.exe	41
PID 2824 wrote to memory of 1792	2824	Unicorn-13666.exe	40
PID 2824 wrote to memory of 1792	2824	Unicorn-13666.exe	40
PID 2824 wrote to memory of 1792	2824	Unicorn-13666.exe	40
PID 2824 wrote to memory of 1792	2824	Unicorn-13666.exe	40
PID 2796 wrote to memory of 2316	2796	Unicorn-33532.exe	42
PID 2796 wrote to memory of 2316	2796	Unicorn-33532.exe	42
PID 2796 wrote to memory of 2316	2796	Unicorn-33532.exe	42
PID 2796 wrote to memory of 2316	2796	Unicorn-33532.exe	42
PID 2728 wrote to memory of 1072	2728	Unicorn-19425.exe	43
PID 2728 wrote to memory of 1072	2728	Unicorn-19425.exe	43
PID 2728 wrote to memory of 1072	2728	Unicorn-19425.exe	43
PID 2728 wrote to memory of 1072	2728	Unicorn-19425.exe	43
PID 2308 wrote to memory of 1924	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	44
PID 2308 wrote to memory of 1924	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	44
PID 2308 wrote to memory of 1924	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	44
PID 2308 wrote to memory of 1924	2308	08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe	44
PID 2740 wrote to memory of 1692	2740	Unicorn-59037.exe	45
PID 2740 wrote to memory of 1692	2740	Unicorn-59037.exe	45
PID 2740 wrote to memory of 1692	2740	Unicorn-59037.exe	45
PID 2740 wrote to memory of 1692	2740	Unicorn-59037.exe	45
PID 2968 wrote to memory of 580	2968	Unicorn-59655.exe	46
PID 2968 wrote to memory of 580	2968	Unicorn-59655.exe	46
PID 2968 wrote to memory of 580	2968	Unicorn-59655.exe	46
PID 2968 wrote to memory of 580	2968	Unicorn-59655.exe	46

C:\Users\Admin\AppData\Local\Temp\08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe
"C:\Users\Admin\AppData\Local\Temp\08572ed4ffe0eb7c7d5f3c9af2867ce696a8ae74b80ef4bfd9a753f10fdebe0fN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9764.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe
        8⤵
        Executes dropped EXE
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        9⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        9⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        9⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe
        8⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        8⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        8⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        7⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50403.exe
        8⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        8⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        8⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        7⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54954.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
        7⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5654.exe
        7⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        8⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        8⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19881.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15860.exe
        6⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        8⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45097.exe
        8⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58832.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        7⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exe
        6⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42702.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        7⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
        8⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        8⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        8⤵
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        7⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        7⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        6⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-771.exe
        7⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59846.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        6⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17276.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15201.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38618.exe
        7⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        7⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        7⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
        6⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14133.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55255.exe
        6⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        6⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17819.exe
        5⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53002.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41176.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exe
        7⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39386.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        8⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        8⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe
        7⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        7⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11253.exe
        6⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe
        7⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        7⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        6⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50837.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        7⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        6⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28450.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33540.exe
        5⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14113.exe
        6⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50989.exe
        5⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46786.exe
        5⤵
        
        PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
        5⤵
        
        PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13739.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10361.exe
        6⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        7⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        6⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
        5⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60613.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25919.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46573.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
      4⤵
      PID:304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
      4⤵
      PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
      4⤵
      PID:7052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13666.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27881.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29884.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24041.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13240.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8130.exe
        7⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45592.exe
        6⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        5⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39386.exe
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        6⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60501.exe
        5⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54954.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48856.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        6⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57040.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        5⤵
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
        5⤵
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38506.exe
        5⤵
        
        PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
      4⤵
      PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13770.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21171.exe
      4⤵
      PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
      4⤵
      PID:6924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
        6⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22033.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 216
        7⤵
        Program crash
        
        PID:4336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 236
        6⤵
        Program crash
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59410.exe
        5⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39467.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
        5⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe
        6⤵
        
        PID:828
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 236
        6⤵
        Program crash
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20179.exe
        5⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        5⤵
        
        PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17142.exe
      4⤵
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33055.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe
      4⤵
      PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
      4⤵
      PID:6848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4419.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
        5⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37336.exe
        6⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        5⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        5⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        5⤵
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36141.exe
      4⤵
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
        5⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
      4⤵
      PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
      4⤵
      PID:7120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
      4⤵
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40237.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15135.exe
      4⤵
      PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
      4⤵
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
      4⤵
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
    3⤵
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
      4⤵
      PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
      4⤵
      PID:6380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55752.exe
    3⤵
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27696.exe
    3⤵
    PID:7152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33532.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27881.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1487.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exe
        7⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        7⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
        6⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36925.exe
        7⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18969.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        7⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55976.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30546.exe
        5⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52489.exe
        6⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44905.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48856.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        6⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60086.exe
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        5⤵
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18338.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        6⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
      4⤵
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19900.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        5⤵
        
        PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35412.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36039.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48109.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51778.exe
        6⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
        7⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        6⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        5⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
        6⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        6⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        6⤵
        
        PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3816.exe
        5⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        5⤵
        
        PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59411.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe
        5⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        6⤵
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        5⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8974.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17406.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        5⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
      4⤵
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
      4⤵
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
      4⤵
      PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36677.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
        6⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        5⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
      4⤵
      PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
      4⤵
      PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32126.exe
      4⤵
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        5⤵
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
      4⤵
      PID:6788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
    3⤵
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
      4⤵
      PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
      4⤵
      PID:6804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
    3⤵
    PID:3208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33423.exe
    3⤵
    PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
    3⤵
    PID:6500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9847.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10745.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        7⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        7⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        6⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        5⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
        6⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19490.exe
        5⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25990.exe
        6⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61223.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
      4⤵
      PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        5⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
      4⤵
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
      4⤵
      PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4891.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42520.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe
        5⤵
        
        PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        5⤵
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
      4⤵
      PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
      4⤵
      PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18338.exe
      4⤵
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58112.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
      4⤵
      PID:6972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe
    3⤵
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
      4⤵
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
      4⤵
      PID:7088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
    3⤵
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe
    3⤵
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
    3⤵
    PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
    3⤵
    PID:6880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7257.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7257.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        6⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
      4⤵
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        5⤵
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8367.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34522.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
      4⤵
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
        5⤵
        
        PID:608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36925.exe
        5⤵
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29354.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
      4⤵
      PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
      4⤵
      PID:6440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38715.exe
    3⤵
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
    3⤵
    PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
    3⤵
    PID:6916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32162.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32162.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21000.exe
      4⤵
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        5⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-281.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32719.exe
        5⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65488.exe
      4⤵
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37116.exe
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11293.exe
      4⤵
      PID:6252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25638.exe
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58112.exe
    3⤵
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
    3⤵
    PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
    3⤵
    PID:6780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4418.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4418.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29277.exe
    3⤵
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47210.exe
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe
    3⤵
    PID:3808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
    3⤵
    PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
  2⤵
  PID:2172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12055.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12055.exe
  2⤵
  PID:3588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23111.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23111.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
  2⤵
  PID:5688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65497.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65497.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13666.exe

Filesize
468KB

MD5
f58266257e131a0cd4e8c6f5fa595383

SHA1
8f55a1f458649e7d6715c585157a0b75986429de

SHA256
18206507c3262072283563d4cd2e2c4b011dabdc2054c645d3088319c9d32c30

SHA512
46fe81efdea69ef0b9978442073a0e30be279f3b6599ec39c40c32edefe8961cb291b15ef5a33f46742cdaabaf0839ab43b8df8ab41bea6f993ac1e93e05ee5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe

Filesize
468KB

MD5
6110a9870d95cc40e7dfa2cace31cfed

SHA1
8d87d35c204f3a9f514d3e0086f38ed0a3ecda90

SHA256
782015536f125a7161374cfe24a1c5b3204bd8c991316a7419dea83179393c72

SHA512
a05c8e25833b47c78b303fc4cacd68f36bde3e072f80a2db99f17dfd2dbaa8ed7f64758ca73f4dfbc1d2d6b00f4ad59743249e1327fa46f71175c685c5ab28f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe

Filesize
468KB

MD5
3ad0be91f3bfd64d47ea19495621b641

SHA1
2443dcb4b958d6c87805c5d1db8e85cdb88bcfdd

SHA256
499783c399ad77c14a1718e43053de0534cd0ecad10378bd2caefe931fd94c0f

SHA512
b9840528d2dba3e34e99d0a8d5b027faad2d6679a75a313347b56c3904cef95c22260acc6cd51d15db003d3e349bbe25deec3aafbf9e98e1b89b0b234f6ca103

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33532.exe

Filesize
468KB

MD5
bd92b18ae96ba4c1d3f66f95705729d8

SHA1
920f4b9a411335ddaa66f2cb0683bdf7e2c0930a

SHA256
ccc80aa8cc2a496c270244712ec96cd270c81f446dcd889d59a0de332a219650

SHA512
5a54a9b5251641ea1561cbc5b21bc46de2efeea46f90afb049dc2ed203e7611d9c1557ee30fbd2ec333ee9f72e8d340037afa7db62a59d9a5581793fbd1e1454

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe

Filesize
468KB

MD5
f3921a9ed89fe45200f4dbcc9b50c651

SHA1
a0223f783caa5e9fe36ee7c5931cf7d038b1a444

SHA256
8d0790bf6776b5a0654b819aa05cc40ed4f2a503f9e024a31ad348d470cb7e1c

SHA512
8d05cee6846dc7b6cc18c793c8c11aa758c781da6a4250e66daaba89acce35bb3cfcfdb29cabf4cef76140618cfe69721c4ccf6d9506b1cdb2196c166f560b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe

Filesize
468KB

MD5
d39e07634dedb67ba3a66b3ff3ac6f8f

SHA1
993cc4f3d659fc3986605f7af38c350d6b302796

SHA256
85977fe8f83e72ab655ca34a44ea5e0d46c913c41676252d09b5c3a2da34c170

SHA512
44d388d2f6944ccfafb6fd8d9c2445cb6913b7052ed3a258c6c4158dd3cc43b801c928709b616532efc5b3654d63b97a76c28d88e590ea9805da41c25ec6d498

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe

Filesize
468KB

MD5
a66a820beecba25fd135e564fe418ddf

SHA1
02abb0f1bb5ac805ada9f60682f50decdde421e3

SHA256
a358fa2a1ed763df1fc874d3079c72c69ae089d7849008bdd12c1fb360fcd167

SHA512
81c654cf3ef97c144180d42dc529ed4ec34da9264bbb4514c87d7d757c7411e89aad4f7a8b55c639a2c1630b1e00732ca7747dee4bfa48e30f6d8c685df9a94f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5654.exe

Filesize
468KB

MD5
b5687812ad61807046dbabda4f40f3d5

SHA1
e3f6fab82caef459765a419bd5c9570f9f448179

SHA256
5b3244b82fd86d387b9fd4c91ad35845a8763ed559a259884ac390762db8552a

SHA512
96870a6198c868d20bf9b18237a01c731631eb4812ee1170b012c82043a90a60ea5d772015a1450e95f802fa7e8a8c30448613cb7b437337b4d92feade804585

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe

Filesize
468KB

MD5
14ab6a76ca4b22c5210372cf572d6cdb

SHA1
936086463e5b7f975b8e76342eb5fa3dda80c2d8

SHA256
33223582a35372f6699706680db503b77fbc7effe82001318b095cb5752ac27e

SHA512
08a75cbc53e1d3dc99545cf0502408ff1ebc183dd9bc0c14d0dd9959b3e3e003dc3c39fb92200f95de6d36caaa2a26800e99071e1ad19f22fc4230fd2d0c41c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe

Filesize
468KB

MD5
b1e8938a3cc90f582589d9f646fc005c

SHA1
fc8e20bba0b9fcfb45b9572fc4864cad4756e351

SHA256
2ccda2665405b078433b172d8537982051916ddb861883505e46f6b98c7be15f

SHA512
cf0f3ee718fd27d8fae4bcadb20a593751c4dcc33f66b25c90f1c804463292e84c801323a68d03b8652afd4cc3df8e89fc2a88b6b16d1608181119e87ebf7017

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe

Filesize
468KB

MD5
9e4200896fd83fcf9d040314f086095c

SHA1
87bb66e8a234909912863b9a00c12279e523621d

SHA256
079aca7d230fce73144e6f439626fb03e14c6fa59927beedde38815daba9a162

SHA512
1cb550f7d7f20bf8a33d931bc9ff3c79d1e12cc81f8d2991c94b17a2ea058b8bcb832bb1a1d6f8c426e0a6236272d5b0f60ae726710c1f7193f62d0de778a8be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe

Filesize
468KB

MD5
cf33eb63d12d8f1f68ade3e703a586dc

SHA1
80d9c486b8a4fac1bc912e9734099c134cedae04

SHA256
350274390c8386f475f5a117ba0fafd1cc5b36f96587b9e937bc2c2f408718c6

SHA512
57c0fbdbb00b54923325643dd4e5443d8a55fd092e81aee3310f3161489c96ba8e2a1e90f109de0b459981ebf1fd14f3c749648e6c114b4c884179680b9c2269

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9847.exe

Filesize
468KB

MD5
9aee2650a11352e3352469d5fa451f3e

SHA1
9ba22993084133d6fd22a63dd946ce72fef7ed64

SHA256
45fe4aeaced01dbdfa3f21f42ccfab473020005d18616f36b87a19fc0853be61

SHA512
ea072bc85253fae6913dc74453234526b266258c15209769368176414d1c060de04dfb41a2da1c41f5a8764bf3773d5dc38f5394cba3e83d30e662ded8a1d39f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe

Filesize
468KB

MD5
b0b78d3d1df0edc74d4724f4f50f05d2

SHA1
3818d35f3029ed8e46ab63eaabef504cecd7b7ad

SHA256
8b0924b7f5e53141a199d4b86c442a7190a1070e669ae27cfac0590f8c4971c3

SHA512
ad5335086713267f018a26586779c000cc771d08ee02929cb9b0d5c7458cdc0f304e3e0048d87e76f03bc10ac175b50f3c619a24c751c4ca9bce905b3f631cb7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe

Filesize
468KB

MD5
1577c44c226e59062364551a299009cc

SHA1
d0b90351446528121a1e5639f9a0163258cf1bd0

SHA256
491552ceab85038132c1eeda24bf1fe528af0fecff2f8ac1f3c192881959219a

SHA512
493cd75a2951b42abefc5f03cfc0ada580d5c7453c665db5a7e3b6c605615e2fdb90629884d90095a953c58c68c01ee4dcb25852768709994bfc67d8629c31a6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe

Filesize
468KB

MD5
24d4e7e8b17b6addece79c82f4fa45ea

SHA1
b27d752c94189133857d564ba889bc15c9fc4d4b

SHA256
1ce8bd58bd7a00b34700686fa2d0190c40f277e568de0069446e88b3579c0f1b

SHA512
5faa05ce40dc0755bd59294afc6a25454bdfd71e4cd5a341c27eb0bb212533d2ba72e52cba19b6542b8f5fe3074a3f3b7a5ace55ef956a06bf459995feed79dd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe

Filesize
468KB

MD5
aca1b9ecb50c0d91058f34ff1ac2c34b

SHA1
b3bd9bb01d8e2595c59190d8276b723981cc214f

SHA256
32d63c553e62ec46265da8011fc53e7b914b0fe7a06df4c7d02df6ae2f3c8c39

SHA512
9e95a9c4aa9355eac71313771331fa27e73e645a71638e624de4ae75b409f2d34f2c27c0a198ff06f9e5a68c7bac071abf02bb961de005aca3b7dbee33466eac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45670.exe

Filesize
468KB

MD5
589d8e4563297093acf030c82a2b17d6

SHA1
e3a911425417cdc084eaf58dd570089a2bf2c212

SHA256
bdb6dbac5e2b7426654ccce40d41a7c799274f57185cab9f0d7bf2095e4a89b8

SHA512
27b59154a53d3acf39cf5d7480806734fee184671ae279f4d4143a5ca0a1b6f7b4e9f6c6ce9239206671d133ed6a040186e369b0b59f44b634ff12cbb1690feb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe

Filesize
468KB

MD5
60f3676725938fdd501753e92f7d5cf1

SHA1
4e425a3cdf0e6abdf2a7d311a769ecef9af68d63

SHA256
58227f7b8a199ab2ad73d7baff82d03da910a18c25dba32904e392a5f54aac3a

SHA512
30e85c42bf87a957d37add1c0d8add0122891e61863c1f0026bdfd16a96eb71bd1bd05ba191a8cbef8e606034380661ca40b76d77971542ad97be8ad9493b3c0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53002.exe

Filesize
468KB

MD5
59d7a07b778c6c3339a4606b3e48f904

SHA1
e70cd4e38266f7ab540d4bda1889cc071e375326

SHA256
54181326c0ae0b2f7a3983e7bcd6272847caa7bfb3f6d1ba89859cbc418c8dfe

SHA512
a93da60bdef6ec897d9a4518a826e75507ec093142017630f34c41d84395158667a4acfbe3309ca241ca683fbb9fdd1811b6278cf7583a5428ab3749841fc52d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe

Filesize
468KB

MD5
a62d36e7ca5d0fe717a80efa5f33b670

SHA1
c8f623a943f68ac99dd71da57c4ba7d54c7437bf

SHA256
2f0743e8d3a8ee660fbabfd1d906aaf49bb080905439a7a3546738035552cde6

SHA512
97950370d822f84aaa01e9cd59fb8fb1ae5603f4d1942b105fd6b85a43c7180a82eac5622f22e971f4dd5ddbf35585552cb01dd1509bda491fe704e2fc46f568

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe

Filesize
468KB

MD5
2b3797011b9da601f976598f00560cac

SHA1
b995f798dd1e2e4d7f5a0c53083fe0d5673a1674

SHA256
9ee82d51b9eb13c2669b12c88a8cf927e7ca6d725d39c6fadd8f4bb2b20e2136

SHA512
d553b784f522990b18fe80b73045f9486356502c29c3904edea94b7412b2a4a80aac2bf504c2ecbb0ee8db8bac9633f0ac63474e6d06359229b8428b172ea8c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe

Filesize
468KB

MD5
a3f80b67d8ddb0598e190b25a52f24c8

SHA1
cb2d98d26ceaff826c52792bf92b906c8417c544

SHA256
598a21ce7842745ce92040805f6301bc5afce9a44afd9ce6d05942d4918c1f60

SHA512
4570d10a6ce7e31f7b1968dae7ce2d6d1ae4f4feafbcebdc1544a0c9f4d336fb7e5fdfc7966aae580a285099629240874f910d33cc5b042ea226669b0c9fdd50

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe

Filesize
468KB

MD5
af82ebb7ae1f22f9d20b650ba6c962ab

SHA1
a5f2b5c9e572d141b8f3793aa659ea700394f903

SHA256
98f98b16b901b237c4390d0dfe60044c7e4906ee7f75f5abe4628473570aaff0

SHA512
dac3e8d420b469d9a2f3e05bbdbce40d0d953a37947d77de5e9451eae06fe3264ceaa33f99f5887dc01601741015b481d9784922cc65c387505e9d3b140bc41f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7257.exe

Filesize
468KB

MD5
69b7a5ba93977b75d04456a6b2747827

SHA1
ec1cdacaf2b4bfa2df8d586679d790c2aa4708d6

SHA256
eb5d4efc5293ef7d8ef983f9d992984a6df2aebb93e1749b942c2537523324f8

SHA512
6356de51358442882b3aef5476c0fc0b856430a5fb485264cf0b34321d3a4790e53d9e346fef3c24216311abe2146a81419a3cbc806f0f195946237a120f5eeb

Download Submit