44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940

Analysis

max time kernel
147s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
Size

468KB
MD5

723839716a0f53448facfed8a3516f17
SHA1

fcdec22259154e48655c83c1cf0ae4080081f5d6
SHA256

44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940
SHA512

07441745300a8001ef58394ec22fb0b828c9362c4b7f661dfe9347ff4d58ed9df370ae1ebd1c9f5a843c33bcbd461dc9697cc8b927d906c0fc188b168625e184
SSDEEP

3072:EYgtogIZb45BtbYtPzqVQf8/YCObZnpsnmHhQEhAtKpMMPUHH0E7:EYqof4BtiP+VQfFphQtK2GUHH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2636	Unicorn-37858.exe
2684	Unicorn-7829.exe
2936	Unicorn-62505.exe
2556	Unicorn-20679.exe
2532	Unicorn-24662.exe
2652	Unicorn-61519.exe
2192	Unicorn-45738.exe
2708	Unicorn-18624.exe
2916	Unicorn-5556.exe
1288	Unicorn-31644.exe
668	Unicorn-60787.exe
1772	Unicorn-14850.exe
2800	Unicorn-15115.exe
2520	Unicorn-13069.exe
1088	Unicorn-24929.exe
2792	Unicorn-39873.exe
2392	Unicorn-19475.exe
1740	Unicorn-48618.exe
2968	Unicorn-45925.exe
448	Unicorn-35711.exe
2504	Unicorn-34227.exe
756	Unicorn-47871.exe
1012	Unicorn-25313.exe
2176	Unicorn-25313.exe
2208	Unicorn-20466.exe
740	Unicorn-64875.exe
2156	Unicorn-13636.exe
1636	Unicorn-13371.exe
2120	Unicorn-30719.exe
2276	Unicorn-12266.exe
1572	Unicorn-16905.exe
996	Unicorn-36771.exe
848	Unicorn-49115.exe
316	Unicorn-55245.exe
1528	Unicorn-65094.exe
2400	Unicorn-65359.exe
2824	Unicorn-40755.exe
2828	Unicorn-12074.exe
2772	Unicorn-61943.exe
2864	Unicorn-33263.exe
2576	Unicorn-10704.exe
3008	Unicorn-19427.exe
1596	Unicorn-27595.exe
2796	Unicorn-53683.exe
2632	Unicorn-33071.exe
2876	Unicorn-26940.exe
2268	Unicorn-42862.exe
1564	Unicorn-62728.exe
1056	Unicorn-9121.exe
1112	Unicorn-46392.exe
536	Unicorn-30933.exe
1892	Unicorn-30668.exe
2148	Unicorn-11067.exe
1676	Unicorn-28494.exe
2384	Unicorn-3028.exe
2944	Unicorn-7311.exe
2956	Unicorn-16242.exe
2212	Unicorn-2406.exe
1776	Unicorn-32926.exe
880	Unicorn-57985.exe
2940	Unicorn-47124.exe
1732	Unicorn-65498.exe
604	Unicorn-63460.exe
984	Unicorn-38140.exe

Loads dropped DLL 64 IoCs

pid	Process
2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
2636	Unicorn-37858.exe
2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
2636	Unicorn-37858.exe
2684	Unicorn-7829.exe
2684	Unicorn-7829.exe
2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
2936	Unicorn-62505.exe
2936	Unicorn-62505.exe
2636	Unicorn-37858.exe
2636	Unicorn-37858.exe
2556	Unicorn-20679.exe
2556	Unicorn-20679.exe
2684	Unicorn-7829.exe
2684	Unicorn-7829.exe
2532	Unicorn-24662.exe
2532	Unicorn-24662.exe
2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
2936	Unicorn-62505.exe
2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
2936	Unicorn-62505.exe
2192	Unicorn-45738.exe
2636	Unicorn-37858.exe
2192	Unicorn-45738.exe
2636	Unicorn-37858.exe
2708	Unicorn-18624.exe
2708	Unicorn-18624.exe
2556	Unicorn-20679.exe
2556	Unicorn-20679.exe
2916	Unicorn-5556.exe
2916	Unicorn-5556.exe
2652	Unicorn-61519.exe
2652	Unicorn-61519.exe
2684	Unicorn-7829.exe
1288	Unicorn-31644.exe
2684	Unicorn-7829.exe
1288	Unicorn-31644.exe
2532	Unicorn-24662.exe
2532	Unicorn-24662.exe
1772	Unicorn-14850.exe
1772	Unicorn-14850.exe
668	Unicorn-60787.exe
2520	Unicorn-13069.exe
668	Unicorn-60787.exe
2520	Unicorn-13069.exe
2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
2936	Unicorn-62505.exe
2936	Unicorn-62505.exe
2636	Unicorn-37858.exe
2800	Unicorn-15115.exe
2636	Unicorn-37858.exe
2800	Unicorn-15115.exe
2192	Unicorn-45738.exe
2192	Unicorn-45738.exe
1088	Unicorn-24929.exe
1088	Unicorn-24929.exe
2708	Unicorn-18624.exe
2708	Unicorn-18624.exe
2792	Unicorn-39873.exe
2792	Unicorn-39873.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2568	316	WerFault.exe	63
952	448	WerFault.exe	48
3764	984	WerFault.exe	93
3360	604	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52629.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
2636	Unicorn-37858.exe
2684	Unicorn-7829.exe
2936	Unicorn-62505.exe
2556	Unicorn-20679.exe
2532	Unicorn-24662.exe
2652	Unicorn-61519.exe
2192	Unicorn-45738.exe
2708	Unicorn-18624.exe
2916	Unicorn-5556.exe
1288	Unicorn-31644.exe
1772	Unicorn-14850.exe
2520	Unicorn-13069.exe
668	Unicorn-60787.exe
2800	Unicorn-15115.exe
2792	Unicorn-39873.exe
1088	Unicorn-24929.exe
2392	Unicorn-19475.exe
1740	Unicorn-48618.exe
2968	Unicorn-45925.exe
448	Unicorn-35711.exe
2504	Unicorn-34227.exe
756	Unicorn-47871.exe
1012	Unicorn-25313.exe
2208	Unicorn-20466.exe
2176	Unicorn-25313.exe
740	Unicorn-64875.exe
2156	Unicorn-13636.exe
1636	Unicorn-13371.exe
2120	Unicorn-30719.exe
2276	Unicorn-12266.exe
1572	Unicorn-16905.exe
996	Unicorn-36771.exe
848	Unicorn-49115.exe
316	Unicorn-55245.exe
2400	Unicorn-65359.exe
1528	Unicorn-65094.exe
2824	Unicorn-40755.exe
2828	Unicorn-12074.exe
2864	Unicorn-33263.exe
2772	Unicorn-61943.exe
2576	Unicorn-10704.exe
3008	Unicorn-19427.exe
1596	Unicorn-27595.exe
2796	Unicorn-53683.exe
2632	Unicorn-33071.exe
2876	Unicorn-26940.exe
2268	Unicorn-42862.exe
1564	Unicorn-62728.exe
1056	Unicorn-9121.exe
1112	Unicorn-46392.exe
536	Unicorn-30933.exe
1892	Unicorn-30668.exe
2148	Unicorn-11067.exe
1676	Unicorn-28494.exe
2384	Unicorn-3028.exe
2944	Unicorn-7311.exe
2956	Unicorn-16242.exe
2212	Unicorn-2406.exe
1776	Unicorn-32926.exe
880	Unicorn-57985.exe
2940	Unicorn-47124.exe
1732	Unicorn-65498.exe
604	Unicorn-63460.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2636	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	30
PID 2624 wrote to memory of 2636	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	30
PID 2624 wrote to memory of 2636	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	30
PID 2624 wrote to memory of 2636	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	30
PID 2624 wrote to memory of 2684	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	31
PID 2624 wrote to memory of 2684	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	31
PID 2624 wrote to memory of 2684	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	31
PID 2624 wrote to memory of 2684	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	31
PID 2636 wrote to memory of 2936	2636	Unicorn-37858.exe	32
PID 2636 wrote to memory of 2936	2636	Unicorn-37858.exe	32
PID 2636 wrote to memory of 2936	2636	Unicorn-37858.exe	32
PID 2636 wrote to memory of 2936	2636	Unicorn-37858.exe	32
PID 2684 wrote to memory of 2556	2684	Unicorn-7829.exe	33
PID 2684 wrote to memory of 2556	2684	Unicorn-7829.exe	33
PID 2684 wrote to memory of 2556	2684	Unicorn-7829.exe	33
PID 2684 wrote to memory of 2556	2684	Unicorn-7829.exe	33
PID 2624 wrote to memory of 2532	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	34
PID 2624 wrote to memory of 2532	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	34
PID 2624 wrote to memory of 2532	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	34
PID 2624 wrote to memory of 2532	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	34
PID 2936 wrote to memory of 2652	2936	Unicorn-62505.exe	35
PID 2936 wrote to memory of 2652	2936	Unicorn-62505.exe	35
PID 2936 wrote to memory of 2652	2936	Unicorn-62505.exe	35
PID 2936 wrote to memory of 2652	2936	Unicorn-62505.exe	35
PID 2636 wrote to memory of 2192	2636	Unicorn-37858.exe	36
PID 2636 wrote to memory of 2192	2636	Unicorn-37858.exe	36
PID 2636 wrote to memory of 2192	2636	Unicorn-37858.exe	36
PID 2636 wrote to memory of 2192	2636	Unicorn-37858.exe	36
PID 2556 wrote to memory of 2708	2556	Unicorn-20679.exe	37
PID 2556 wrote to memory of 2708	2556	Unicorn-20679.exe	37
PID 2556 wrote to memory of 2708	2556	Unicorn-20679.exe	37
PID 2556 wrote to memory of 2708	2556	Unicorn-20679.exe	37
PID 2684 wrote to memory of 2916	2684	Unicorn-7829.exe	38
PID 2684 wrote to memory of 2916	2684	Unicorn-7829.exe	38
PID 2684 wrote to memory of 2916	2684	Unicorn-7829.exe	38
PID 2684 wrote to memory of 2916	2684	Unicorn-7829.exe	38
PID 2532 wrote to memory of 1288	2532	Unicorn-24662.exe	39
PID 2532 wrote to memory of 1288	2532	Unicorn-24662.exe	39
PID 2532 wrote to memory of 1288	2532	Unicorn-24662.exe	39
PID 2532 wrote to memory of 1288	2532	Unicorn-24662.exe	39
PID 2624 wrote to memory of 1772	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	40
PID 2624 wrote to memory of 1772	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	40
PID 2624 wrote to memory of 1772	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	40
PID 2624 wrote to memory of 1772	2624	44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe	40
PID 2936 wrote to memory of 668	2936	Unicorn-62505.exe	41
PID 2936 wrote to memory of 668	2936	Unicorn-62505.exe	41
PID 2936 wrote to memory of 668	2936	Unicorn-62505.exe	41
PID 2936 wrote to memory of 668	2936	Unicorn-62505.exe	41
PID 2192 wrote to memory of 2800	2192	Unicorn-45738.exe	42
PID 2192 wrote to memory of 2800	2192	Unicorn-45738.exe	42
PID 2192 wrote to memory of 2800	2192	Unicorn-45738.exe	42
PID 2192 wrote to memory of 2800	2192	Unicorn-45738.exe	42
PID 2636 wrote to memory of 2520	2636	Unicorn-37858.exe	43
PID 2636 wrote to memory of 2520	2636	Unicorn-37858.exe	43
PID 2636 wrote to memory of 2520	2636	Unicorn-37858.exe	43
PID 2636 wrote to memory of 2520	2636	Unicorn-37858.exe	43
PID 2708 wrote to memory of 1088	2708	Unicorn-18624.exe	44
PID 2708 wrote to memory of 1088	2708	Unicorn-18624.exe	44
PID 2708 wrote to memory of 1088	2708	Unicorn-18624.exe	44
PID 2708 wrote to memory of 1088	2708	Unicorn-18624.exe	44
PID 2556 wrote to memory of 2792	2556	Unicorn-20679.exe	45
PID 2556 wrote to memory of 2792	2556	Unicorn-20679.exe	45
PID 2556 wrote to memory of 2792	2556	Unicorn-20679.exe	45
PID 2556 wrote to memory of 2792	2556	Unicorn-20679.exe	45

C:\Users\Admin\AppData\Local\Temp\44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe
"C:\Users\Admin\AppData\Local\Temp\44ea25957b638b3f5b784fa50d0f14d858c1c3fe0a1d3c90ca20c335e43ed940.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62505.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65359.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        8⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        8⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        8⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57800.exe
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        8⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9318.exe
        7⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
        7⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17743.exe
        7⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        6⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26076.exe
        7⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18649.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        7⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
        6⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64072.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
        6⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        6⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe
        6⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54254.exe
        7⤵
        
        PID:284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58971.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56749.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63528.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47518.exe
        6⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42219.exe
        6⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        6⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37321.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        6⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        6⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58755.exe
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        6⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27548.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6877.exe
        5⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9977.exe
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        5⤵
        
        PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60787.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40300.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        9⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        9⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        9⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        9⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2383.exe
        9⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
        9⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44695.exe
        8⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        8⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        8⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        8⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14570.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        7⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30055.exe
        6⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15359.exe
        7⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28244.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56749.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9921.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56292.exe
        6⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27425.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10778.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49202.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        6⤵
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        6⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2406.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23388.exe
        6⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        7⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24845.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28751.exe
        6⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6818.exe
        6⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4813.exe
        5⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41317.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35094.exe
        6⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        6⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58883.exe
        6⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        5⤵
        
        PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19958.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
        5⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37754.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        5⤵
        
        PID:7496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64875.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
        5⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        6⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
        6⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        6⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        6⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9276.exe
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        5⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        5⤵
        
        PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30668.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        5⤵
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51710.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11423.exe
        5⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        5⤵
        
        PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
      4⤵
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37375.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45792.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
      4⤵
      PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
      4⤵
      PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe
      4⤵
      PID:7328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        7⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50435.exe
        8⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        8⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        8⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        7⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        7⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1467.exe
        6⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31790.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
        7⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8373.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        6⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43484.exe
        6⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11067.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exe
        5⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43995.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27305.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        6⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        6⤵
        
        PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62449.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10074.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7915.exe
        5⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        5⤵
        
        PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30719.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe
        6⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36013.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        7⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56407.exe
        7⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
        6⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        6⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        5⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31790.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32914.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58593.exe
        6⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
        6⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        5⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        5⤵
        
        PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26940.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        5⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57477.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44545.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        6⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        6⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        5⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52437.exe
        5⤵
        
        PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49656.exe
      4⤵
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30264.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        5⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        5⤵
        
        PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44084.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
      4⤵
      PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
      4⤵
      PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe
      4⤵
      PID:7352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
        6⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57800.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        7⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33419.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55579.exe
        6⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
        6⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
        5⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        6⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54140.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        6⤵
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11692.exe
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        6⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33240.exe
        5⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27238.exe
        5⤵
        
        PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42862.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        5⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
        6⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60694.exe
        5⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        5⤵
        
        PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exe
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51639.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
        5⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
        5⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
        5⤵
        
        PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62449.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
      4⤵
      PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26294.exe
      4⤵
      PID:7748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        5⤵
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14565.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        5⤵
        
        PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23039.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
      4⤵
      PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
      4⤵
      PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
      4⤵
      PID:7320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57800.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        5⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        5⤵
        
        PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
      4⤵
      PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe
      4⤵
      PID:7928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3651.exe
    3⤵
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
      4⤵
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44305.exe
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1148.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
      4⤵
      PID:7400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20773.exe
    3⤵
    PID:2908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27909.exe
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40573.exe
    3⤵
    PID:5316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
    3⤵
    PID:5632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
    3⤵
    PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
    3⤵
    PID:7368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24929.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32926.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
        8⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54140.exe
        8⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
        8⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42063.exe
        7⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25100.exe
        7⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        7⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14640.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        7⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        6⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31797.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        6⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        6⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exe
        7⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15245.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11692.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        7⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64622.exe
        6⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        6⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33066.exe
        6⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        6⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
        6⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18218.exe
        5⤵
        
        PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59155.exe
        5⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
        5⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36771.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        6⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        7⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        7⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22758.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        6⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
        5⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35094.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
        6⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        6⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52834.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37624.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        5⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16456.exe
        5⤵
        
        PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53730.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4285.exe
        6⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2338.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25067.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
        5⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        5⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        5⤵
        
        PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12432.exe
      4⤵
      PID:324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
        5⤵
        
        PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
      4⤵
      PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29873.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26742.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exe
      4⤵
      PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
      4⤵
      PID:7068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
        6⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exe
        7⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
        7⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe
        7⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23698.exe
        6⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51710.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31982.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        6⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39278.exe
        6⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51472.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40778.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        6⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53766.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
        5⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
        5⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51540.exe
        5⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11332.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39645.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        5⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        5⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        5⤵
        
        PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31019.exe
      4⤵
      PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
      4⤵
      PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
      4⤵
      PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
      4⤵
      PID:7296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63460.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10782.exe
        6⤵
        
        PID:1472
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 236
        6⤵
        Program crash
        
        PID:3360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 236
        5⤵
        Program crash
        
        PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
      4⤵
      Executes dropped EXE
      PID:984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 240
        5⤵
        Program crash
        
        PID:3764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 240
      4⤵
      Program crash
      PID:952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
      4⤵
      PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
        5⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9921.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
        5⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63528.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50917.exe
      4⤵
      PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
      4⤵
      PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
      4⤵
      PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
      4⤵
      PID:7336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59657.exe
    3⤵
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
      4⤵
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
      4⤵
      PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
      4⤵
      PID:7276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37662.exe
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
    3⤵
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
    3⤵
    PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
    3⤵
    PID:5492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
    3⤵
    PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
    3⤵
    PID:7536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe
        6⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        7⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
        7⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        6⤵
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18706.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32643.exe
        6⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        6⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3522.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        6⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
        6⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        6⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        6⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
        5⤵
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41911.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7220.exe
        5⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1483.exe
        5⤵
        
        PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27595.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60850.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
        6⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        6⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        6⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
        5⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        5⤵
        
        PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
      4⤵
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
        5⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21177.exe
        5⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        5⤵
        
        PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9318.exe
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
      4⤵
      PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45254.exe
      4⤵
      PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
      4⤵
      PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34227.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12074.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        5⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28220.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        6⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62393.exe
        5⤵
        
        PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
      4⤵
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        5⤵
        
        PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11692.exe
        5⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        5⤵
        
        PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
      4⤵
      PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47033.exe
      4⤵
      PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
      4⤵
      PID:7688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61943.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58390.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63984.exe
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53901.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
        5⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56487.exe
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
      4⤵
      PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
      4⤵
      PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
      4⤵
      PID:7772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exe
    3⤵
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
      4⤵
      PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
      4⤵
      PID:7608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
    3⤵
    PID:2416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3423.exe
    3⤵
    PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
    3⤵
    PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
    3⤵
    PID:6936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe
    3⤵
    PID:7192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47871.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        5⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51393.exe
        6⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15529.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
        5⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        5⤵
        
        PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      4⤵
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        5⤵
        
        PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
      4⤵
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
      4⤵
      PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
      4⤵
      PID:7628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2775.exe
      4⤵
      PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16013.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        5⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        5⤵
        
        PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48826.exe
      4⤵
      PID:696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
      4⤵
      PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16114.exe
      4⤵
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
      4⤵
      PID:7980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exe
    3⤵
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25381.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
      4⤵
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
      4⤵
      PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34500.exe
      4⤵
      PID:7420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe
    3⤵
    PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13250.exe
    3⤵
    PID:6976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52629.exe
    3⤵
    PID:7504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20466.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20466.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30933.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52142.exe
      4⤵
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15529.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11423.exe
      4⤵
      PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
      4⤵
      PID:7552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14570.exe
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
    3⤵
    PID:4308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12222.exe
    3⤵
    PID:6772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
    3⤵
    PID:7696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55432.exe
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11332.exe
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39645.exe
    3⤵
    PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe
    3⤵
    PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
    3⤵
    PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2383.exe
    3⤵
    PID:7108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
    3⤵
    PID:7756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27909.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27909.exe
  2⤵
  PID:3744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
  2⤵
  PID:4848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36489.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36489.exe
  2⤵
  PID:5204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
  2⤵
  PID:6332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
  2⤵
  PID:7228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe

Filesize
468KB

MD5
d61f38e40b1abdf661906d7c8cc26d8f

SHA1
42d3f3f6d5af06b24f739865a2b4628800ecbf9d

SHA256
c08d8f916ce305b30b7b955daee116415361686d26c1ba585232186d6ba31599

SHA512
5a4d1727974fc01ed85cb946471356d610b310a36c42b9c574aa4743f8b139e8fc18c993e45448f9e793854784b1f48c4f18f328c1194c1030a131b69b87adbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe

Filesize
468KB

MD5
bba5cd7bf7d8cff127559fd6d2f8e9b2

SHA1
2ec7f79603eab004b7ccfe4ecdc2dbcc60ad4147

SHA256
edbaff3543802a6308cb3f41f17c0325e6c01542988b6591546cb4fcced76fec

SHA512
bde1cdc492267a0d0213ce42c9fdeafd4d2d4ed0d9b3d02243667ef5e0d491a39646785098843e098fb9d0638bc8d50dc46c55855f0b5afd254be418c34cd593

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe

Filesize
468KB

MD5
0b3798e2f4d28ce21077642af1a735f6

SHA1
ac6c8560b2353dfde3727140da6ab639a820987c

SHA256
eabeb2c1f2873768ad484a5eab8ec966f8437ec33f8f9cab8547c833a4233f9f

SHA512
1842796f72a49cd27bfb0365cb6653573fb7e55c66f410402387962fc33f62fd16d87cd6a9ed61462fe5b8eae45506734ea56fe9cac087a9cefc64d6f3b6c29c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42219.exe

Filesize
468KB

MD5
d9b542701b2edcd28403289566df6f89

SHA1
90e71046cecb99b8a34e0ad5420849e1ee329011

SHA256
53c881ea795af0b0301a8656a415d38e3e88052057bc8592e956f3e5df56d76d

SHA512
ce81dbab13a12f24de1c601360c1dcac2bfbb804414ab361f4fde916c3dacd5eb0f66a4f45ee45f69108b3a77e7bc71dcdb523150e9c02a50b1715d99d395f83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe

Filesize
468KB

MD5
e0f8cb130bd7340c3a458c5dbe5d47f0

SHA1
0d4c23848b624aefe41915c6268543f8a326035b

SHA256
f06466c7deadf9e4a291d9272dce172d60edf563fe9a853b558cb76c26516683

SHA512
0c48d02835b0e9980e2b9fdf647de76e075adafd65ce1a788d00b6a00aec455c12ec9feac7561d970e7ee242f851e18c52403686162facccad83bb86b520bc5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe

Filesize
468KB

MD5
042b03bf5608ec5f5384c1b35053ea84

SHA1
b339d2ff1db602322760ebdc18d2901c01558580

SHA256
ffd8114f41b5151624e25ccc945ca58783e99b6cdd67e1e5b494a302a65dec6d

SHA512
fdebde7ccaf5bc857bb3fd9fae7f39631c54fbd151858be1e94088f3e0bae341b0292c925a9c50038041d09bc6953253a687e426e2cc4314e62b00b8d01c3191

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60787.exe

Filesize
468KB

MD5
fb2346dc8a15a1096e7210248da20932

SHA1
f55433ecc474c6e6ff3f3bb69ca14286c173a24a

SHA256
4e419c8f2af064dbff12daefb78f986a9a2f3eb21989bfbc4cd08d5e43368a8d

SHA512
c9ede64b6413e1964e7bbc571e087629402481d39bbb10f070d0972dd7c5b3743c416c040f4a7161ee16c79f5767888e979dfddb36b281eafd1d70ecc2b9b7c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe

Filesize
468KB

MD5
38cd81450b128dad47d4835c6d9e7921

SHA1
9ed0128f72a2765015d0ede0da3b8af87df32bd8

SHA256
0c1e48fc5de82d9c4341546eae14df429ab8c7bb8723f032f14ab556a1451a26

SHA512
b431a93c89512fff8fdd53e38d4f74a1e76af6a76137b0f9b90238bea8e415a5404935a104684e7916fa82f807465caac299103ccd4980004fabcee1bf0dd7a9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe

Filesize
468KB

MD5
0f9889587576316ea324de4459788c35

SHA1
9fa732f6e2cf9858b19e313b0e97380c1a4704c3

SHA256
f1d466a172df35d1d98fee3fd938908bb6023f55990fbecbb049986fd55d508e

SHA512
5b60680ccfa95f478e614589040f73c9426e9369aeaa6c5768aeebf092ae3d0b92c0618a9af33406c413d13f7e229bc295e5a3133a8842bd0bac5af2e92d402d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe

Filesize
468KB

MD5
5fc35ed1695f73fd4c4ea6380eae4062

SHA1
a87de103ac5d25eed083af94113600a665c1f7df

SHA256
abf3058c9c60d41d9c3bfa8503a410764853fb6bcb4cfdd93fd7398581b01248

SHA512
0ae5ff1c6282ae5294d7c7df89b849e04cefa990613941d71994cd3b0a824d9651dbcf2b1a123ba35f49ab0211c2e6e13cc6a8c1a4cdac10fe7a497bbedb58e6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe

Filesize
468KB

MD5
94e14ba871b733e1c0bc0477a9e00916

SHA1
49c300bf8d26a5bfce6502634a6d9bfcad53cf75

SHA256
0473aa5a56cd59fd1b0d28065b8968605f4d7015aca161e800d6300315ebd0b3

SHA512
dad9cf4147f4a2575dc54f8eeeb38da33e385b4b886a6112563bf42cd355a128d05600b5451fa5bb54a55f01885931d7737998dc3008e71f2bbfc72c5c6bb03a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe

Filesize
468KB

MD5
16f61c9ce05bc7963d97c82d889d8a8f

SHA1
722b9399d8b0c84dd49014183184a8bc07f933ac

SHA256
05832a06ca28dcb1cb02b1e9cd6b23266a74acf4b904cdc83355a8317ae7a6bf

SHA512
842bd4cfff878eb4a75b84169367421784eeeed4be2202c810facc28c088b8b61307c37b0b661012298ecc389aacdbac1f1437caabfa9fa58b9ba4198afb082f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24929.exe

Filesize
468KB

MD5
60beaf65031b9d065c5dccfb50e014ce

SHA1
35604a99f428c954a1ae6f0963659c071b1ba0a9

SHA256
2f0aaad4261710d9266741a8de6a3a96f37a8b8e0353ae243e5a42068bd31f57

SHA512
446d7423390653c30f8571b633b71a29467a6e538f2c4991850666bbac2af584694d29dbf4b098757df6f100be8f932c506647b833773881f67fae0e1efd0836

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe

Filesize
468KB

MD5
7833a275bf49cc4535e50101ddf825d7

SHA1
a4f71d99d45c57cdeae8ab84b3d0281f21be144f

SHA256
fdc2b7f60aa4bd03e6720fc30a91bb7fec67b26d936ee9edeff6a0a88611af29

SHA512
d108b943af849a69972ef4736eb40790f86756685ffe903c4a3dd810f4b96887ad0ef719b109dbc9a1786df071b404d15105b54709351d552c841d97261fa5f3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe

Filesize
468KB

MD5
40f674fb07810d2c2bc5c1327f87b90c

SHA1
17edb14871555a30007de7adab26eef29a2fe3c7

SHA256
f138e59b93ba9a3a982956f761e0ec75de60fb44a366dd9c942a7c7029b81212

SHA512
2295fbae7f7731003b0883650bceb6c0c66286a01f2033b77a7300e8972062bd1119a6249de10f3d55ee2da74126cab69993b4f29996dac0e7f8de18c1e83341

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe

Filesize
468KB

MD5
fa9d415b64aab3ca4266806aa3f8f581

SHA1
9c1140f8991d71802768f7a6d9b60a6b0fd50db5

SHA256
4dd12ba4ff431b421e23dc6c2fdab08f752045c592a6aa0ae995481f4e709d40

SHA512
f796b60a24601ba4d926cc214ecf91906952849e79c1201a4012061d84e3d89253f2d3fcdf130cf7581bb6fb501c78f29d9e5acffa036fa476af79b87f4b0407

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe

Filesize
468KB

MD5
e799e71b60707510682f6ef8c8f49372

SHA1
ebb03134285e6e0d39c299a2d80f67822a9860a3

SHA256
8933a04e0e92319e01c9a488bc606f4b32e5eca2a448afae74facc28f161a9e6

SHA512
23fd9cf0ebedabaf40531414f84ce743358e0a3d2de67fad5809a3cadfa23c882feff47244de75b2edbbbe10a172761f4816a417862122b1e922cfe51716bf69

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62505.exe

Filesize
468KB

MD5
6109254aaaf87537713aa418dc8780ca

SHA1
bf0eab4be55d1e2a60fd0e49a1547e51d7a7640e

SHA256
b21b27e591d2a83750c376b676ef383f597e3f6dc7de16d2532815525ed5403a

SHA512
bbe0649f369187ccdc426aa796c109c93aaa366926399361feabf307410d72a9be4cdc203572b8a6a88d929ae2ea731619bbe3a99833215a6dc6d7c29fe844a8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe

Filesize
468KB

MD5
e6d4f5927157d064910385cbb1f3dde1

SHA1
fab1d836082261ad04da2346315338a38348301d

SHA256
30e7bda0e7410df18fbb1f6a13f40b4ef735ed52fb4c9df7dd10d2e35a3c171b

SHA512
2164b6ac7c1ef1ee70b51211d47a8883a85a867cf112c51ca21be3cccb847c5596dd3d27ce40d6961d3dc5f993742d6ec3a981e45ed9a2f35b8ece55143eeb19

Download Submit