3007cab9b368f21f1e316ca8f4fe9064fafbc1f49e03e5fc48194c9176e548f8

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a671f1a7540649e17ec6169eaff5e20N.exe
Size

184KB
MD5

9a671f1a7540649e17ec6169eaff5e20
SHA1

ae0361885ffd478bab9597d4e47307062800c2fe
SHA256

3007cab9b368f21f1e316ca8f4fe9064fafbc1f49e03e5fc48194c9176e548f8
SHA512

4bce1334d94ad782ceff20fc433e3ab4af7869bde1840927978d707f7df74206edb7662113e8b63222f3e1fe5ab87077eaad175fc4667715743c09ae6ba0b40a
SSDEEP

3072:NRR1uzohdjGPXIYtElZ8Dpdglvnvnviut:NROoivIY28VdglPvnviu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1468	Unicorn-32975.exe
2684	Unicorn-7204.exe
2340	Unicorn-3867.exe
2656	Unicorn-29566.exe
2768	Unicorn-57365.exe
2920	Unicorn-61086.exe
2524	Unicorn-5755.exe
2576	Unicorn-1190.exe
2160	Unicorn-6021.exe
2896	Unicorn-26271.exe
2748	Unicorn-14573.exe
552	Unicorn-27999.exe
1464	Unicorn-30036.exe
2852	Unicorn-35902.exe
2924	Unicorn-36167.exe
2380	Unicorn-36909.exe
1828	Unicorn-25211.exe
2912	Unicorn-20573.exe
2864	Unicorn-36254.exe
304	Unicorn-24704.exe
1824	Unicorn-35102.exe
1184	Unicorn-49400.exe
1520	Unicorn-65166.exe
1648	Unicorn-5030.exe
832	Unicorn-8559.exe
2460	Unicorn-126.exe
1108	Unicorn-49592.exe
2096	Unicorn-13390.exe
2004	Unicorn-62591.exe
2252	Unicorn-8751.exe
2448	Unicorn-16920.exe
1936	Unicorn-44278.exe
1696	Unicorn-32580.exe
2256	Unicorn-52830.exe
2584	Unicorn-63036.exe
2648	Unicorn-11989.exe
1720	Unicorn-8460.exe
2628	Unicorn-17937.exe
2764	Unicorn-51605.exe
2676	Unicorn-44086.exe
2668	Unicorn-59545.exe
2504	Unicorn-59545.exe
2520	Unicorn-34584.exe
2316	Unicorn-47848.exe
2824	Unicorn-20567.exe
2940	Unicorn-56007.exe
2124	Unicorn-9798.exe
680	Unicorn-24097.exe
1968	Unicorn-14859.exe
1924	Unicorn-31689.exe
584	Unicorn-58423.exe
1064	Unicorn-64553.exe
1380	Unicorn-49561.exe
1496	Unicorn-40433.exe
1900	Unicorn-39857.exe
2040	Unicorn-36519.exe
2068	Unicorn-19498.exe
2136	Unicorn-39364.exe
2052	Unicorn-64745.exe
2152	Unicorn-1246.exe
836	Unicorn-45264.exe
1600	Unicorn-5922.exe
3052	Unicorn-17439.exe
1016	Unicorn-31314.exe

Loads dropped DLL 64 IoCs

pid	Process
1948	9a671f1a7540649e17ec6169eaff5e20N.exe
1948	9a671f1a7540649e17ec6169eaff5e20N.exe
1468	Unicorn-32975.exe
1948	9a671f1a7540649e17ec6169eaff5e20N.exe
1468	Unicorn-32975.exe
1948	9a671f1a7540649e17ec6169eaff5e20N.exe
2684	Unicorn-7204.exe
2684	Unicorn-7204.exe
1468	Unicorn-32975.exe
1468	Unicorn-32975.exe
2340	Unicorn-3867.exe
1948	9a671f1a7540649e17ec6169eaff5e20N.exe
2340	Unicorn-3867.exe
1948	9a671f1a7540649e17ec6169eaff5e20N.exe
2656	Unicorn-29566.exe
2656	Unicorn-29566.exe
2684	Unicorn-7204.exe
2684	Unicorn-7204.exe
2920	Unicorn-61086.exe
2920	Unicorn-61086.exe
2340	Unicorn-3867.exe
2340	Unicorn-3867.exe
1468	Unicorn-32975.exe
2768	Unicorn-57365.exe
1948	9a671f1a7540649e17ec6169eaff5e20N.exe
2524	Unicorn-5755.exe
2768	Unicorn-57365.exe
1468	Unicorn-32975.exe
1948	9a671f1a7540649e17ec6169eaff5e20N.exe
2524	Unicorn-5755.exe
2656	Unicorn-29566.exe
2576	Unicorn-1190.exe
2656	Unicorn-29566.exe
2576	Unicorn-1190.exe
2160	Unicorn-6021.exe
2160	Unicorn-6021.exe
2684	Unicorn-7204.exe
2684	Unicorn-7204.exe
2748	Unicorn-14573.exe
2748	Unicorn-14573.exe
2340	Unicorn-3867.exe
2340	Unicorn-3867.exe
2852	Unicorn-35902.exe
2852	Unicorn-35902.exe
1948	9a671f1a7540649e17ec6169eaff5e20N.exe
1948	9a671f1a7540649e17ec6169eaff5e20N.exe
2920	Unicorn-61086.exe
2920	Unicorn-61086.exe
2896	Unicorn-26271.exe
2896	Unicorn-26271.exe
1468	Unicorn-32975.exe
1464	Unicorn-30036.exe
1464	Unicorn-30036.exe
1468	Unicorn-32975.exe
2768	Unicorn-57365.exe
2768	Unicorn-57365.exe
2524	Unicorn-5755.exe
2524	Unicorn-5755.exe
552	Unicorn-27999.exe
552	Unicorn-27999.exe
2924	Unicorn-36167.exe
2924	Unicorn-36167.exe
2380	Unicorn-36909.exe
2576	Unicorn-1190.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1580	1696	WerFault.exe	62
2172	2588	WerFault.exe	99
3384	432	WerFault.exe	196
9108	7356	WerFault.exe	743

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-85.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6150.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1948	9a671f1a7540649e17ec6169eaff5e20N.exe
1468	Unicorn-32975.exe
2684	Unicorn-7204.exe
2340	Unicorn-3867.exe
2656	Unicorn-29566.exe
2768	Unicorn-57365.exe
2920	Unicorn-61086.exe
2524	Unicorn-5755.exe
2576	Unicorn-1190.exe
2160	Unicorn-6021.exe
2896	Unicorn-26271.exe
1464	Unicorn-30036.exe
2852	Unicorn-35902.exe
552	Unicorn-27999.exe
2748	Unicorn-14573.exe
2924	Unicorn-36167.exe
2380	Unicorn-36909.exe
1828	Unicorn-25211.exe
2912	Unicorn-20573.exe
2864	Unicorn-36254.exe
304	Unicorn-24704.exe
1824	Unicorn-35102.exe
1184	Unicorn-49400.exe
1648	Unicorn-5030.exe
1520	Unicorn-65166.exe
832	Unicorn-8559.exe
2096	Unicorn-13390.exe
1108	Unicorn-49592.exe
2460	Unicorn-126.exe
2004	Unicorn-62591.exe
2252	Unicorn-8751.exe
2448	Unicorn-16920.exe
1936	Unicorn-44278.exe
1696	Unicorn-32580.exe
2256	Unicorn-52830.exe
2648	Unicorn-11989.exe
2584	Unicorn-63036.exe
1720	Unicorn-8460.exe
2628	Unicorn-17937.exe
2764	Unicorn-51605.exe
2668	Unicorn-59545.exe
2504	Unicorn-59545.exe
2520	Unicorn-34584.exe
2676	Unicorn-44086.exe
2316	Unicorn-47848.exe
2824	Unicorn-20567.exe
2940	Unicorn-56007.exe
584	Unicorn-58423.exe
1380	Unicorn-49561.exe
2124	Unicorn-9798.exe
680	Unicorn-24097.exe
1968	Unicorn-14859.exe
1496	Unicorn-40433.exe
2052	Unicorn-64745.exe
1924	Unicorn-31689.exe
1900	Unicorn-39857.exe
2068	Unicorn-19498.exe
2136	Unicorn-39364.exe
1064	Unicorn-64553.exe
2152	Unicorn-1246.exe
836	Unicorn-45264.exe
2040	Unicorn-36519.exe
1600	Unicorn-5922.exe
3052	Unicorn-17439.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1468	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	30
PID 1948 wrote to memory of 1468	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	30
PID 1948 wrote to memory of 1468	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	30
PID 1948 wrote to memory of 1468	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	30
PID 1468 wrote to memory of 2684	1468	Unicorn-32975.exe	31
PID 1468 wrote to memory of 2684	1468	Unicorn-32975.exe	31
PID 1468 wrote to memory of 2684	1468	Unicorn-32975.exe	31
PID 1468 wrote to memory of 2684	1468	Unicorn-32975.exe	31
PID 1948 wrote to memory of 2340	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	32
PID 1948 wrote to memory of 2340	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	32
PID 1948 wrote to memory of 2340	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	32
PID 1948 wrote to memory of 2340	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	32
PID 2684 wrote to memory of 2656	2684	Unicorn-7204.exe	33
PID 2684 wrote to memory of 2656	2684	Unicorn-7204.exe	33
PID 2684 wrote to memory of 2656	2684	Unicorn-7204.exe	33
PID 2684 wrote to memory of 2656	2684	Unicorn-7204.exe	33
PID 1468 wrote to memory of 2768	1468	Unicorn-32975.exe	34
PID 1468 wrote to memory of 2768	1468	Unicorn-32975.exe	34
PID 1468 wrote to memory of 2768	1468	Unicorn-32975.exe	34
PID 1468 wrote to memory of 2768	1468	Unicorn-32975.exe	34
PID 2340 wrote to memory of 2920	2340	Unicorn-3867.exe	35
PID 2340 wrote to memory of 2920	2340	Unicorn-3867.exe	35
PID 2340 wrote to memory of 2920	2340	Unicorn-3867.exe	35
PID 2340 wrote to memory of 2920	2340	Unicorn-3867.exe	35
PID 1948 wrote to memory of 2524	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	36
PID 1948 wrote to memory of 2524	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	36
PID 1948 wrote to memory of 2524	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	36
PID 1948 wrote to memory of 2524	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	36
PID 2656 wrote to memory of 2576	2656	Unicorn-29566.exe	37
PID 2656 wrote to memory of 2576	2656	Unicorn-29566.exe	37
PID 2656 wrote to memory of 2576	2656	Unicorn-29566.exe	37
PID 2656 wrote to memory of 2576	2656	Unicorn-29566.exe	37
PID 2684 wrote to memory of 2160	2684	Unicorn-7204.exe	38
PID 2684 wrote to memory of 2160	2684	Unicorn-7204.exe	38
PID 2684 wrote to memory of 2160	2684	Unicorn-7204.exe	38
PID 2684 wrote to memory of 2160	2684	Unicorn-7204.exe	38
PID 2920 wrote to memory of 2896	2920	Unicorn-61086.exe	39
PID 2920 wrote to memory of 2896	2920	Unicorn-61086.exe	39
PID 2920 wrote to memory of 2896	2920	Unicorn-61086.exe	39
PID 2920 wrote to memory of 2896	2920	Unicorn-61086.exe	39
PID 2340 wrote to memory of 2748	2340	Unicorn-3867.exe	40
PID 2340 wrote to memory of 2748	2340	Unicorn-3867.exe	40
PID 2340 wrote to memory of 2748	2340	Unicorn-3867.exe	40
PID 2340 wrote to memory of 2748	2340	Unicorn-3867.exe	40
PID 2768 wrote to memory of 552	2768	Unicorn-57365.exe	42
PID 2768 wrote to memory of 552	2768	Unicorn-57365.exe	42
PID 2768 wrote to memory of 552	2768	Unicorn-57365.exe	42
PID 2768 wrote to memory of 552	2768	Unicorn-57365.exe	42
PID 1468 wrote to memory of 1464	1468	Unicorn-32975.exe	41
PID 1468 wrote to memory of 1464	1468	Unicorn-32975.exe	41
PID 1468 wrote to memory of 1464	1468	Unicorn-32975.exe	41
PID 1468 wrote to memory of 1464	1468	Unicorn-32975.exe	41
PID 1948 wrote to memory of 2852	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	43
PID 1948 wrote to memory of 2852	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	43
PID 1948 wrote to memory of 2852	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	43
PID 1948 wrote to memory of 2852	1948	9a671f1a7540649e17ec6169eaff5e20N.exe	43
PID 2524 wrote to memory of 2924	2524	Unicorn-5755.exe	44
PID 2524 wrote to memory of 2924	2524	Unicorn-5755.exe	44
PID 2524 wrote to memory of 2924	2524	Unicorn-5755.exe	44
PID 2524 wrote to memory of 2924	2524	Unicorn-5755.exe	44
PID 2656 wrote to memory of 1828	2656	Unicorn-29566.exe	46
PID 2656 wrote to memory of 1828	2656	Unicorn-29566.exe	46
PID 2656 wrote to memory of 1828	2656	Unicorn-29566.exe	46
PID 2656 wrote to memory of 1828	2656	Unicorn-29566.exe	46

C:\Users\Admin\AppData\Local\Temp\9a671f1a7540649e17ec6169eaff5e20N.exe
"C:\Users\Admin\AppData\Local\Temp\9a671f1a7540649e17ec6169eaff5e20N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17439.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        9⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
        10⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exe
        10⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        10⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
        10⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        9⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        9⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
        9⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        9⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        9⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        9⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exe
        8⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        9⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        10⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30778.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        10⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        10⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        10⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
        10⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        9⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        9⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exe
        9⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53394.exe
        9⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37567.exe
        9⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        9⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
        8⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exe
        9⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        9⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        9⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-151.exe
        9⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
        9⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        8⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20022.exe
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe
        8⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        8⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        7⤵
        Executes dropped EXE
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        8⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37657.exe
        9⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16616.exe
        9⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
        9⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        9⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37467.exe
        9⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36161.exe
        9⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17791.exe
        8⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        8⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        8⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        7⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44057.exe
        8⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58080.exe
        8⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        8⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22530.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37498.exe
        8⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exe
        7⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        8⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
        7⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 200
        7⤵
        Program crash
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62645.exe
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60077.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exe
        7⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe
        6⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        6⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25211.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        7⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        8⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5485.exe
        8⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25157.exe
        8⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2441.exe
        7⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28166.exe
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41146.exe
        7⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21501.exe
        6⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        7⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        8⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        8⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        8⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        7⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exe
        7⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
        6⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exe
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58997.exe
        6⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-142.exe
        6⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 244
        7⤵
        Program crash
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34044.exe
        6⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51217.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        7⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28732.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4894.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        6⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe
        6⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
        5⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        6⤵
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1909.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        6⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17716.exe
        6⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        5⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40900.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        5⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        5⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        5⤵
        
        PID:9000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11989.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65487.exe
        7⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exe
        8⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18719.exe
        9⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58314.exe
        9⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        9⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62386.exe
        9⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        9⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47461.exe
        7⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
        8⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41793.exe
        8⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        8⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
        7⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2145.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        7⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        6⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5028.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41184.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
        7⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exe
        6⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        7⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49061.exe
        6⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39098.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17289.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        7⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        6⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
        6⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        6⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        6⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8256.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        7⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2332.exe
        6⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29030.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        7⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54934.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9239.exe
        7⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        6⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        6⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51765.exe
        5⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37657.exe
        6⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33533.exe
        6⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        6⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37584.exe
        5⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13653.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        6⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        6⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21800.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
        5⤵
        
        PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        5⤵
        
        PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
        6⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        7⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        7⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5745.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
        6⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55601.exe
        5⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        6⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60457.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6475.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16839.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        6⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        5⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58846.exe
        6⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
        5⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6303.exe
        5⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
        5⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7929.exe
        5⤵
        
        PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51605.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41559.exe
        5⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        6⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36358.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        6⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12957.exe
        6⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20562.exe
        5⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12543.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16071.exe
        5⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-175.exe
        5⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14991.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
      4⤵
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        5⤵
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        5⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        5⤵
        
        PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
      4⤵
      PID:432
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 240
        5⤵
        Program crash
        
        PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41564.exe
      4⤵
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58598.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33645.exe
      4⤵
      PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39986.exe
      4⤵
      PID:8656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27999.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49561.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
        7⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
        8⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37574.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4710.exe
        8⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        8⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40025.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        7⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55012.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23051.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45674.exe
        6⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42264.exe
        7⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50379.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36858.exe
        6⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5432.exe
        6⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45967.exe
        6⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        6⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59398.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5074.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55831.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9784.exe
        7⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9422.exe
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61946.exe
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53904.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
        6⤵
        
        PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
        5⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24552.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exe
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1914.exe
        6⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45232.exe
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        5⤵
        
        PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45672.exe
        6⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
        7⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65049.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        6⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        6⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11168.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
        5⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe
        5⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
        5⤵
        
        PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1246.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        5⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
        6⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53014.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22247.exe
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11114.exe
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40238.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12542.exe
        5⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61457.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exe
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        7⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59222.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        6⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        6⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36518.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59507.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64957.exe
        5⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
        5⤵
        
        PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41071.exe
      4⤵
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        6⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58800.exe
        6⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26846.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        5⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13341.exe
        5⤵
        
        PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5841.exe
      4⤵
      PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33903.exe
      4⤵
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
      4⤵
      PID:9028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64553.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35112.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20578.exe
        7⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47923.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
        7⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63570.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25292.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        6⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12617.exe
        5⤵
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8355.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9086.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        5⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63372.exe
        5⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47747.exe
        5⤵
        
        PID:8232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        5⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        5⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53254.exe
        5⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14952.exe
        5⤵
        
        PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
      4⤵
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45278.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5157.exe
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63397.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20038.exe
        5⤵
        
        PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
      4⤵
      PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62476.exe
      4⤵
      PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49438.exe
      4⤵
      PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38162.exe
        5⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        5⤵
        
        PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
      4⤵
      PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
      4⤵
      PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
      4⤵
      PID:8852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56007.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
      4⤵
      PID:656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57341.exe
        5⤵
        
        PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-503.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
      4⤵
      PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29906.exe
      4⤵
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
      4⤵
      PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
      4⤵
      PID:8912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19721.exe
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
    3⤵
    PID:6940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
    3⤵
    PID:7720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61086.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24097.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
        7⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exe
        8⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17186.exe
        8⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1262.exe
        8⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28929.exe
        8⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8273.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        7⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        6⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7908.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
        6⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exe
        6⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12178.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        6⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
        5⤵
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27111.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
        6⤵
        
        PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18615.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15206.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe
        5⤵
        
        PID:8580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31689.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        6⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        7⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48426.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        7⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
        6⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38536.exe
        6⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe
        5⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12870.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        5⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17793.exe
        5⤵
        
        PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39027.exe
        5⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        6⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        6⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46710.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        5⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe
        5⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        5⤵
        
        PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
      4⤵
      PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57645.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-488.exe
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
      4⤵
      PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
      4⤵
      PID:9100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30866.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
        7⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9775.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23914.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe
        7⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21169.exe
        6⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29906.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-186.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7471.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37946.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe
        7⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62505.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7701.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-757.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        6⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        6⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        5⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27770.exe
        6⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30330.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58025.exe
        7⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6295.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42181.exe
        6⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        6⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4205.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58555.exe
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26867.exe
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        5⤵
        
        PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
      4⤵
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
        6⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52213.exe
        6⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        5⤵
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        5⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        5⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37306.exe
        5⤵
        
        PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15850.exe
      4⤵
      PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48678.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13767.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
      4⤵
      PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28766.exe
      4⤵
      PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
      4⤵
      PID:8696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
        5⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
        6⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40683.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14138.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        7⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7372.exe
        6⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42508.exe
        6⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31857.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        5⤵
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        5⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
        5⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        5⤵
        
        PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
      4⤵
      PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        5⤵
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38050.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        6⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55083.exe
        6⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25032.exe
        5⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44727.exe
        5⤵
        
        PID:9076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7956.exe
      4⤵
      PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37702.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
      4⤵
      PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42212.exe
      4⤵
      PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe
      4⤵
      PID:8964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
      4⤵
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe
        5⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57876.exe
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58594.exe
        6⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61984.exe
        6⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        5⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        5⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31338.exe
        5⤵
        
        PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe
      4⤵
      PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5745.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1046.exe
      4⤵
      PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
      4⤵
      PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
      4⤵
      PID:8280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-423.exe
    3⤵
    PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
      4⤵
      PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29360.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
      4⤵
      PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
      4⤵
      PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exe
      4⤵
      PID:8868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
    3⤵
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exe
      4⤵
      PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44235.exe
      4⤵
      PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
      4⤵
      PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
      4⤵
      PID:8860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44558.exe
    3⤵
    PID:3332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
    3⤵
    PID:5708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
    3⤵
    PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
    3⤵
    PID:7176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
    3⤵
    PID:8420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5755.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5755.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36167.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16920.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40433.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13336.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41955.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
        6⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32824.exe
        6⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        5⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6340.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52258.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        5⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11810.exe
        5⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64003.exe
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7471.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        5⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        5⤵
        
        PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33368.exe
      4⤵
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        5⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62079.exe
        5⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50446.exe
        5⤵
        
        PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28298.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
      4⤵
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
      4⤵
      PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42998.exe
      4⤵
      PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59464.exe
      4⤵
      PID:9112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39364.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23189.exe
        5⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        6⤵
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        6⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38574.exe
        6⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3458.exe
        5⤵
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17845.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46368.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31146.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        5⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10614.exe
      4⤵
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        5⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        6⤵
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49346.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19817.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53394.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
        5⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        5⤵
        
        PID:8556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
      4⤵
      PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23976.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26767.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33946.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        5⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe
        5⤵
        
        PID:9012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51730.exe
      4⤵
      PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
      4⤵
      PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51231.exe
      4⤵
      PID:7884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58971.exe
      4⤵
      PID:8312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37766.exe
      4⤵
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49069.exe
        5⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        5⤵
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4285.exe
        5⤵
        
        PID:8252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13845.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
      4⤵
      PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
      4⤵
      PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe
      4⤵
      PID:7756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
    3⤵
    PID:3020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24780.exe
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
    3⤵
    PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
    3⤵
    PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44539.exe
    3⤵
    PID:7336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10998.exe
        5⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        6⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exe
        7⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38079.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55640.exe
        6⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
        5⤵
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43450.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        5⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55012.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39387.exe
        5⤵
        
        PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55793.exe
      4⤵
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        5⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47508.exe
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        6⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55672.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
        5⤵
        
        PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9116.exe
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        5⤵
        
        PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42414.exe
      4⤵
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51448.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47731.exe
        5⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        5⤵
        
        PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34847.exe
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
      4⤵
      PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39788.exe
      4⤵
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
      4⤵
      PID:8116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
      4⤵
      PID:8212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
      4⤵
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        5⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40340.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        6⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        6⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        5⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38574.exe
        5⤵
        
        PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
      4⤵
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        5⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
        5⤵
        
        PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
      4⤵
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58727.exe
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
      4⤵
      PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
      4⤵
      PID:9156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
    3⤵
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
        5⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        5⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27900.exe
        5⤵
        
        PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56497.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
      4⤵
      PID:8284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21714.exe
    3⤵
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60275.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exe
      4⤵
      PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3202.exe
      4⤵
      PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
      4⤵
      PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3933.exe
      4⤵
      PID:8436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59705.exe
    3⤵
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
    3⤵
    PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
    3⤵
    PID:6548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
    3⤵
    PID:7784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12985.exe
    3⤵
    PID:8484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65166.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65166.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14859.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
      4⤵
      PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27597.exe
      4⤵
      PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
      4⤵
      PID:7820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
    3⤵
    PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18748.exe
      4⤵
      PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6488.exe
      4⤵
      PID:8372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe
    3⤵
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48546.exe
    3⤵
    PID:7664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39533.exe
    3⤵
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27732.exe
    3⤵
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5303.exe
    3⤵
    PID:5864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
    3⤵
    PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
    3⤵
    PID:7348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
    3⤵
    PID:8400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
  2⤵
  PID:3220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17667.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17667.exe
  2⤵
  PID:4784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
  2⤵
  PID:5872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
  2⤵
  PID:7020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe
  2⤵
  PID:7356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7356 -s 188
    3⤵
    - Program crash
    PID:9108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43883.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43883.exe
  2⤵
  PID:8276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12178.exe

Filesize
184KB

MD5
a2ea11625e5131682707d5fc2eaebb7b

SHA1
c1d559dc4a335f8ad18d93459aaf2291e5d7b273

SHA256
0b7d2ccc01cb19258b1bc02258c0aeb6e2e9d462def1e9fb7e4593d43002e513

SHA512
3f9e6bd791e5f7235895181862b0942b3a1c919addaa2c094a82e64457320465bc872d5c2f4db58e141da714255376117abbbb57ccf1ecdf260f29ad9dff8da6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe

Filesize
184KB

MD5
b1edc7be2c3ef5d27dd8bb662b21337b

SHA1
ccede89ed344f47aa4475e8cb894bd81be88a31c

SHA256
54911631f1f61b4cdd96151d694abb98e4b0138c32a8b549f0ba39b9c6be75ae

SHA512
f36dc2b80a8042ada0c0b84fa7f6a057cadc0f743425f148a1dfc4ffaed3d6cd1e8cceb344cf0544bdc9f68f84252746024fa42041979abc5559a75dc2450af5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe

Filesize
184KB

MD5
ad1baedc187bc5d600b0e3247887e59c

SHA1
82b00f4d824fe0dd6b87c1c079a6b658124d58ac

SHA256
b9e683cacbff3e832f5e697a1520ab854540783372fc731e9cc7a8c2d7a77c69

SHA512
9112d1c89ca97af016b574498b11a352be4505c82d26990b90f90cfd2819c06610f5a28bb4308f930dc593c5fc3f3deb9a4b308a6557605d7386e70823ba8216

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe

Filesize
184KB

MD5
7ed3d0c0cc74b34f9cb6d4f85fda1e06

SHA1
f62ea3694a9cedd070630b41232fc5cdc25d267d

SHA256
20758f5cab2e99e359f3ebc790d7f55809f80bd7bfde52e6abe4a4fbc3fd8c68

SHA512
36a5d467d07894abad879daaffd9f696e18bf0cdf439deeeddc02bea07c1effb7b18ebc379a29f5084695963d6eaf9b45800704de84a1ef7e6b52156321976bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe

Filesize
184KB

MD5
e2bdf1fd9bef6925d827e1940ce45ef7

SHA1
a3049273c3998834d40824a3245bcc65d5ef0bf0

SHA256
22ba776f2aa0706cf354e90ba703921c7644901f91561eebf4f2b61c4ca249d4

SHA512
ed0605fc7d202e54f3c33fee9e38d605f9f399634a6c5dfca487ae74395ad58487814e1a242c9a28f07fdff5cc1fbb176e8d8d4ff874ff6d510e3f815327e149

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1914.exe

Filesize
184KB

MD5
5b2b1a758635556704f808bd81515b59

SHA1
fb33b8db99038f82776ac01ad50bb6532ffb0361

SHA256
abac2082cba5df3cb8f7e1088ee85ff9d09c700603b82cf0dc8145bf2e2df6ae

SHA512
46cd7bf185f0d7d6a09a70b83409c6e1d33e1a8b2ca0a9de643c0705c0b58d6777392fbc25bd5dc7a55293dade834c63cd5d7c6aca953d84b494ef84e6f20339

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe

Filesize
184KB

MD5
a44cbfbabe9b96469db9a69868924e28

SHA1
7bee053af04fadfb6c4599fef47c43e805bb0483

SHA256
4b4acdbc8a3e9ddb1639bead5700e7d856fdefb4dcdbdb0d4042eb75e55cde08

SHA512
a7e0686ea2b48a780a3643860ba357811373dace15f922be6c914fa242fe625c338ce4da1193aa0543ff184693e0a9291e1499f64c3a47d7f7ec6d5bfd1442f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22247.exe

Filesize
184KB

MD5
84a01f9cdad1f05696ad202a0d01f5d6

SHA1
0a4b43373c24a004f81a5719ae6bbca89008b9e1

SHA256
d0fcdd27b1dad7bdc9d4f3af76b8e3c095d917b38a9889734389e83fcced589e

SHA512
fe33066ae2c5dda9ebf1d33717b3906e2f65ddbf5fd846d0b38b21b3ff87cecc02ae7a8604a6a7c398bd4a9a2d3612d6bcc4e966779fbaca04c005848d8ad7ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe

Filesize
184KB

MD5
08cb9a7bd341e60d8cae5a62a0682f26

SHA1
36cadb41fcad047b4b294d6cc4bbf85544f8a50f

SHA256
e83d5347db2991a3613211b01ec48c465518c45d23f5c0f000cb24edf14524dc

SHA512
845c72c29f8af6746bd0bc7c2d7469233c6668f31c8035ee3d31ba77dc1ead626781aaefd90246a7d187985c9fab8c5d78722725ee5b855b7e8cdfa8d1a65e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27999.exe

Filesize
184KB

MD5
214b95edacde1b14a36865840fd2c03b

SHA1
cbdde4bfbdccd341ddbef73c284180ef1e7547fa

SHA256
75be49376e38c8964fba6e1d75686df0e92292eb881110c316a5d09988814cba

SHA512
ddd8530b4cf8f2e28d669287c5c8032791ffef33d8a6315d7931e24856f36dabb160bc3197f10dc8c265e6ded69cbda6f410fe695a72699f79599eaa55733f7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33533.exe

Filesize
184KB

MD5
11f49e787d862d8a19478be21baef42c

SHA1
e0f341d5907841b72543a5dd71e7f8a34d1fb2f4

SHA256
c0d3b868d2f35b0a2936f14f0e7cf850e1c2079b2a85b06b7131ad2c0beb5be2

SHA512
81489112430a3b77fbdc5730d3f783e907d42f8f4ea8efdd2d3ad20eae7fade631663929327703aadde5de3be3d5fee5f583f7ea32a5cdb48d9b7e9ed3d80c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37584.exe

Filesize
184KB

MD5
aff794467bcaface38867d4380a3532d

SHA1
f728ee0c2049bac8c486b522497646a4e4b003c7

SHA256
1ed8f9d086ae4fe102c33bd1ca2cbcbe064c08b67cd57dc25f969d8f26cde57e

SHA512
6c2199e16c9167caf78d744ff8aa8971313fc3387e0a72bda6a4186a3f06ab34cc20d2ed5b25486724d56e142f022d6e3355ef827149d5d9eb692124c6f5b966

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe

Filesize
184KB

MD5
96747ff2d06305e410f7b996e7931846

SHA1
447a7db7bef8840f4ef46c6386541ace1d5f8afa

SHA256
c967c581f4257f95cdfa76b816ca9eea12096740e50e4f6e3e3fd4c294fc8df6

SHA512
eba2f1f7386c3f7ff56d1a4b2a6a55d03a034508bd59717b24bb0be184ec11485608a7f90521c52c5ef20e390a921ca71a93901b92b336975816313631013ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45967.exe

Filesize
184KB

MD5
6738d4f00ebe26cf8258f334d1c46f70

SHA1
2c7eb691715f2ca65b314d72a31e9f79277fbf89

SHA256
d87c840a782bcf313e475ce11a14601314538dfc1cf4297f1ca05a152f06f2ae

SHA512
036f42e233bb218482412c3ca5df456181fce2caa8a1eeb16e347572083245de02610c492e98cba620229713c0ba51aed9391bf0326d27cf3e0548742ec2488f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe

Filesize
184KB

MD5
d06c4152c21adebda0f3f93688e61c6a

SHA1
e5b35e55d775d85cc752e5328a430a83d96d55e2

SHA256
8545fdfb19bf27ff4ab952880a8447b967ac42fba3c374df064abf2b5b82b97f

SHA512
5fad2b5b7dd7b4bc307c925a138223cbf033111128c0e61c22876f083caaa04c4bd532252f36ff9d9bea33e357a66915cf20e2c23277fe3162ae8b22cff7578c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe

Filesize
184KB

MD5
dbfd0d33f8e4b4d85b5456acff5d7fd6

SHA1
97a35694a5d8890b71ae9f886905f74c3e1bf759

SHA256
a4b51f9ef495aa5154e0f1ef50240d5e95773ed7fa91e77778df697dbce163f6

SHA512
1d7866636710f3c6279436d330a7c94eb4e6059e5adf3b9b4b3962a169e9ad3799c0bca987c7083b7a4566366e060be777b257275b446abbaf9086a8a8c35d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe

Filesize
184KB

MD5
75ca9a02f6fefd43b5086b7bb97488a6

SHA1
30fbf2a8bdda445a9adaef96ce6f35935a76df65

SHA256
8019ec71188b87af903f0a7b4109ced1d8161bf6df7b4f88ed2c72f9d84fd3f2

SHA512
586f0a54b97e1f5dfc30796bbc00cb4af5b30fe3ab24b8aa621d92134b3bd6860c6c255d3b5571634e05b1988c1922075ccda0aa005eeb168fb0d58e84c9d8c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe

Filesize
184KB

MD5
cb2ac5ce8e86a13047d8c113ae3985e6

SHA1
1697f86426dc60414d47e99790a25fa08fd064f5

SHA256
e4c3186bef7c9eee4b8c7ffe7ad7746bbb6c64e79aceff532ef974d0530e75b3

SHA512
e12af328d691cf5bc02ce75f07f05b5e6d821e9ec7c9036e4a2060129a83efe8c0bbbcd4a9a9e7caaeab8ca231ac7d41d6090b5f7a003b9a46157e3876aceea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe

Filesize
184KB

MD5
60d28b7569b922826a9815f98434034c

SHA1
adf0352ec8f2fe97a7c8139f444df0b9c82707c9

SHA256
71f598d6fe8884de3a326d9e509d5103b909833b01e36f029be4d2aeb2631821

SHA512
2bcae2ff90f226facc7cd12e816c86daf0001f4fae782d220f0fe806b2c9815eb681cac6f07f45c4dd6193cd3790cd274b9e8eeb8ec8670812a340eb1ae89ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe

Filesize
184KB

MD5
c078fc4cd32a58e3aa1221fa740cfedb

SHA1
8010f78cf1783ac92b215d1e4c3bab31c08ad661

SHA256
04f3fd0e4dfa93c831d8523f16f99352c10ab9449fb76146e2db47619c25d6a3

SHA512
602625dcf0615ed2575bbc852362b4f970d1d4cfa57dfefe18a0af75395a56f01d776dc7e368fdc2129c89a7cecd9aebef8954fc6781777bed39a160216a01b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7908.exe

Filesize
184KB

MD5
49dcba56573aafaf55d3cc43d413d653

SHA1
3dd9c4ab211bf96e467c31cfd5df87bd09b4611e

SHA256
48ef1b4497d281031cfd609598ef34bb595297fb644f6328daacda34b8a9d86e

SHA512
e6d8ba8d94c361c60828ac3447b8440b25b1091453f05b310a84af5ee4956ac47b87e7081cb4fe3cae340dd03efe3cd6e766615964fba15a617ac4b47b001d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe

Filesize
184KB

MD5
8f20aea4179917917b794956c0a2fe07

SHA1
f056ea2c371134076da5a896bbe7e7dab1209ed3

SHA256
79d27b2fea2456cb4250c293a605ee5bb2879558f0185bebb72d22322fa5f5fe

SHA512
d3bb5ba5d2e993cdb85ca798bfc37fbd4de6a1046ca2738f5111808c3667d29e283ec4fdfe50cd4265d6eccd47f5fbf6985830b57e1f5de6eb2c15116b50b730

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe

Filesize
184KB

MD5
d683a0af696ae47c44e3466deba50b0c

SHA1
358e047ea2eb3455f907ee275479c613eeec916f

SHA256
9b70a739789577af0827187f3e0b8cee8cfd009b9b9700a7df6d5048437090dc

SHA512
a5ac75ae4d0f1ad7eca0a86bd950142a2e3ce49bdb5e8af69ce00da2c0986894da996e2c0f5ef683132b660284e701c0be796914a117a6d78a186f43f6b44c1f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe

Filesize
184KB

MD5
bd339fce0ac9d8ba00529b78e48f38d8

SHA1
eefd21c28b75598ed73097755a8f348d7a7e2ac9

SHA256
3f0ff5f8927dac9d95415f57e1bd08d23be083c4ac87f6e2ee8630d84f4a7797

SHA512
c30ebce255b7aee15a3157b984b6801659df94401ce0a21ddbf864615e61b56c39cd002a2e972e3c31c9faeb80c93fd1a53301dab54c519c88a5205c7d6e171e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25211.exe

Filesize
184KB

MD5
53fad54c047ea248b108a5ed8a7b3b3b

SHA1
0d7d92de489740794d04bb93ab7494a8d2848575

SHA256
76c1fa962aa099e2b8ed0f6712643c72aeac157409f443fa5b126c6cc798a095

SHA512
e07863e9ea4de3defaf7246bcb0f568676a320f576721c980739f507b7e5f630a5f92563c15d46af0756a8fb30931f002a682bdbc622277161d4822e65b22239

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe

Filesize
184KB

MD5
c85046f49fcb23060808e6471914f647

SHA1
386e23f0e8a428a3a765bbf2d1843084d3891474

SHA256
1e9f7c99ce674b5371b65519ed47a5555eb17e659a3a19d929b78470907bf995

SHA512
932666d362be80731e2ebfa6a1268b358fa68fa3fd0194ebb699814bf9962c16a9010ad21224461bee66744d3503aee3d84e04ac709817332b1de6df6d0182eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe

Filesize
184KB

MD5
7e4f53f9044df78855859bc9b2d98c1b

SHA1
5b9be709c1359f5a85d82959dd4aa1e7ef23a30d

SHA256
54122f7cb7a392ee07ccbaa4ffd456eefe978469ebb9829c8df80914b28fba4a

SHA512
49de2119d208fa55ed2cd3236df8bcc8b06ace400f571e50edf208b3d6c082bf301eab20332957b2fff4db9af8480851dc4e1edded322b01782e4d98bd503701

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe

Filesize
184KB

MD5
e0d636a1e8c3d134119f6e45f7ee16bd

SHA1
8390e4e1f6975bc75d84236738bdc95b9f7a0b46

SHA256
5f37554c2f9279d9a1b9644d240c0bd62091d31b2474bf6f1d97f282af8aafc4

SHA512
899852baaf27d5a0519e76330b44816550b914fcbe894fbcac265647666e0caa3ea976f2db2e450185cbeabd12079c36e32c5e17391e592b90583377c45bb784

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe

Filesize
184KB

MD5
8f5348b10a74cb8b42cb91c47679df92

SHA1
7ca5f5b0cdcae7dd569306b91cc87e40448cc2de

SHA256
dbe2fa732bd68de285560fe2b821dfaa2013ceda12261a0e892bdd4a3ded6220

SHA512
f4383498947f82ed1ecc5bb3742ab8123bd1e5e30f5adab82a90af2d81552815904d698fd477439c8f38c4015ffbe85a6de46654bb4a452ca0f9a9234260a1bd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe

Filesize
184KB

MD5
18c61e76f90c8b89734b899eee44d88e

SHA1
9cfaeaea850804cdb315d8d3eef3059eb078fde9

SHA256
0079820e4b0b3953774fc109bdc7e3d8805cc74a62399d7d56d9c2390aad48c6

SHA512
b26b4a0869e366d4150219c7d95e050f88dcf85c776f18afcec5b8ddcf1feb4e1fa7aafa278211bff61eae716d7fe358b543cdcfd2603331ee0989523530ec21

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36167.exe

Filesize
184KB

MD5
fa9f40d1acd7da9dbdf210229ff03ec4

SHA1
594541974b0c690425a592315923e1e231cc43be

SHA256
ba75ae4e992ee58bdb72b331071da7d97d88790f455c0a73bd32d3e69420cb1e

SHA512
c162d7cda0cae9f93e79020de41cca4d150e5d4f48026694ef63ff96680666d7a19e92d837b557370f443c66dd86bdd967cfbe5206f1b395fe96aff74da2e03b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe

Filesize
184KB

MD5
520e805d930003bf35ccec7b9806098a

SHA1
90b30367f9fc693b4f04d5430773666c359e2cef

SHA256
661242eadd00ea89e9d1bb338128974c1dcf4e98ab89b75fff7903cc11df960d

SHA512
a3f126a2ee7e8c1a5eeec012d958d18eb5bec6cb8d4fda717d3a86c817375ace5f6551d1cacd981fe0e7d2a75f7608daf4d3c011f72af65ff63dad6b9774b084

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe

Filesize
184KB

MD5
63c8bba092bfcedac8072aa48bdecafe

SHA1
8ec1532baf1a9e6342654bd461c6bb0fd38c85e3

SHA256
d225ae8322ee2c185a310333be96e71ddd177dd7478d2e12b8348c938702035e

SHA512
64e080af4480decabf8d826aceb78b498f3b14f06f975cfee086d37a7025491092a1200ed1593e689495e03ec2a8a50bdc8b655a8cff50eed26ba24a10ef3800

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe

Filesize
184KB

MD5
776df8c1bc265932d35dc17499a3bb9c

SHA1
d576b5123f85660950dd2945ad3b3358bf3d6d0c

SHA256
50a3fa5c0a35c7c8cee76013f2e6e2fa113014e406acb18be27f090159e724d1

SHA512
9f63f89d4bd60b861f2246c3bd98106959a7f0bd1762d26acf492ab0af3b072f02379ca1bcfc384e2542ab3df4124b98bcfcfa4302d2510e9615f9a61c9e4241

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5755.exe

Filesize
184KB

MD5
2d7870235264a657edb0643a4a2620c9

SHA1
94beab9a430f313b5004dd7481aac59ea51dcc53

SHA256
6b8dd1655cbf8b21558928420ecada4329c220dd3752dab986c13f3a92475b98

SHA512
c7f5267621e41c114f9bef2e9d47bca03c6d93b4a7dd607f862e459acb4073d2ed80b3a2032588f1826f560f8787c29286c0503abf9eec2b9cbec3ea46421bf6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe

Filesize
184KB

MD5
819e7276f774cea7edf9810c1b0eb06f

SHA1
7f28123c7d735bf91624f67d420bd532d778295c

SHA256
e042030740de6dc575f964aea4c83f7b2b816e05530a7def2bba5418a26ce5f8

SHA512
2cf51b13ca9dd3c8179ed7c272e407b53f67086e82453621d088e3fe35560b98b8fa911850b1ff9d4d15d052e27bd2bf66b5c2c08fb0bd8f171395cd90940752

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61086.exe

Filesize
184KB

MD5
c25b29ab1f501ccf343cfe577e70191d

SHA1
8b64089c474aa1ed1edbab3ac4b537d29116477c

SHA256
df1d186beb26e9fbe06df0c38d5190924370754623ab73cadd86bd74bb983d1d

SHA512
97f80c06e300c4071be65ab51c23f044278f08ba6b6a09dec85ce6113d28041c89eb5c2122fc7f6b85b826321e00000f9f2bedfd52aeccba4b872c8bf66d8695

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe

Filesize
184KB

MD5
37d5f0a5ff65f3f330d5eb4576e33c13

SHA1
2648919bb0ccf2ff366ac450bc72d26fcd2cbe16

SHA256
b4bb7cbf2e8b7488b0fb81a94fef668929708250546229326f18f4edcc854f28

SHA512
a1ccb8ecc18a483f3fe53a7e62c467ad419e656f5aa75adc5e9cc3ce8be84bf5941f2977e98cc9ec4c5056fbeac68a5be5f35cd91ca9e5baeea44dfb9e6714a6

Download Submit