b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca

Analysis

max time kernel
148s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
Size

468KB
MD5

add2499c140460edd669726a2277bbeb
SHA1

466500a24dcb20c475ce4d7e204695710a3bc0b5
SHA256

b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca
SHA512

45704bffadb44f6a55d1b6c46e12d3aafdc41eb96f5e8a7005df79ee0eec8cf4ba2da3ae09b4edd37f2579cb51e0112150dfc808417838adcb2e1889b47f94a5
SSDEEP

3072:yu0VogWGII5AtGYQzYFTff8wFChCPppIJEHCYV1udqBLgJVu1vlk:yueoJIAtUz4TffrfKjdqdMVu1

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2636	Unicorn-27977.exe
2684	Unicorn-62958.exe
2784	Unicorn-51028.exe
2556	Unicorn-16810.exe
2588	Unicorn-29939.exe
2604	Unicorn-10073.exe
2192	Unicorn-56481.exe
2708	Unicorn-58278.exe
2916	Unicorn-43599.exe
1288	Unicorn-46937.exe
1552	Unicorn-2597.exe
900	Unicorn-8727.exe
1056	Unicorn-40366.exe
1892	Unicorn-59967.exe
2132	Unicorn-32324.exe
2352	Unicorn-31674.exe
1940	Unicorn-30714.exe
908	Unicorn-310.exe
352	Unicorn-15421.exe
1252	Unicorn-4861.exe
2504	Unicorn-44533.exe
684	Unicorn-50663.exe
288	Unicorn-8068.exe
556	Unicorn-60798.exe
1632	Unicorn-37948.exe
740	Unicorn-41063.exe
1588	Unicorn-18619.exe
2044	Unicorn-24343.exe
2024	Unicorn-10564.exe
2124	Unicorn-63315.exe
1176	Unicorn-30451.exe
324	Unicorn-59402.exe
1668	Unicorn-59624.exe
2244	Unicorn-46019.exe
2728	Unicorn-12919.exe
2736	Unicorn-19050.exe
2768	Unicorn-64337.exe
2220	Unicorn-18666.exe
2856	Unicorn-12343.exe
3012	Unicorn-1561.exe
2564	Unicorn-17248.exe
1592	Unicorn-2220.exe
1992	Unicorn-2220.exe
2796	Unicorn-29090.exe
2880	Unicorn-48691.exe
2716	Unicorn-48956.exe
1496	Unicorn-20861.exe
572	Unicorn-25721.exe
1384	Unicorn-55779.exe
1112	Unicorn-31852.exe
1656	Unicorn-53149.exe
2144	Unicorn-19635.exe
2100	Unicorn-47612.exe
1908	Unicorn-27746.exe
2224	Unicorn-18146.exe
2380	Unicorn-21484.exe
2972	Unicorn-4955.exe
2628	Unicorn-59917.exe
1156	Unicorn-48982.exe
2488	Unicorn-9781.exe
1684	Unicorn-22204.exe
1732	Unicorn-42070.exe
2992	Unicorn-7487.exe
1240	Unicorn-59833.exe

Loads dropped DLL 64 IoCs

pid	Process
2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
2636	Unicorn-27977.exe
2636	Unicorn-27977.exe
2784	Unicorn-51028.exe
2784	Unicorn-51028.exe
2684	Unicorn-62958.exe
2684	Unicorn-62958.exe
2636	Unicorn-27977.exe
2636	Unicorn-27977.exe
2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
2556	Unicorn-16810.exe
2556	Unicorn-16810.exe
2784	Unicorn-51028.exe
2784	Unicorn-51028.exe
2604	Unicorn-10073.exe
2604	Unicorn-10073.exe
2636	Unicorn-27977.exe
2636	Unicorn-27977.exe
2588	Unicorn-29939.exe
2588	Unicorn-29939.exe
2684	Unicorn-62958.exe
2684	Unicorn-62958.exe
2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
2708	Unicorn-58278.exe
2708	Unicorn-58278.exe
2556	Unicorn-16810.exe
2556	Unicorn-16810.exe
2192	Unicorn-56481.exe
2192	Unicorn-56481.exe
1288	Unicorn-46937.exe
1288	Unicorn-46937.exe
2604	Unicorn-10073.exe
2604	Unicorn-10073.exe
2916	Unicorn-43599.exe
2916	Unicorn-43599.exe
2784	Unicorn-51028.exe
900	Unicorn-8727.exe
2784	Unicorn-51028.exe
900	Unicorn-8727.exe
1056	Unicorn-40366.exe
2588	Unicorn-29939.exe
1056	Unicorn-40366.exe
2588	Unicorn-29939.exe
1892	Unicorn-59967.exe
2684	Unicorn-62958.exe
1892	Unicorn-59967.exe
2684	Unicorn-62958.exe
2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
1552	Unicorn-2597.exe
1552	Unicorn-2597.exe
2636	Unicorn-27977.exe
2636	Unicorn-27977.exe
2132	Unicorn-32324.exe
2132	Unicorn-32324.exe
2352	Unicorn-31674.exe
2352	Unicorn-31674.exe
2708	Unicorn-58278.exe
2708	Unicorn-58278.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3184	2904	WerFault.exe	106
3988	3692	WerFault.exe	230
6476	6364	WerFault.exe	567
6488	6372	WerFault.exe	568

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22230.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
2636	Unicorn-27977.exe
2784	Unicorn-51028.exe
2684	Unicorn-62958.exe
2556	Unicorn-16810.exe
2192	Unicorn-56481.exe
2604	Unicorn-10073.exe
2588	Unicorn-29939.exe
2708	Unicorn-58278.exe
2916	Unicorn-43599.exe
1288	Unicorn-46937.exe
900	Unicorn-8727.exe
1056	Unicorn-40366.exe
1552	Unicorn-2597.exe
1892	Unicorn-59967.exe
2132	Unicorn-32324.exe
2352	Unicorn-31674.exe
1940	Unicorn-30714.exe
908	Unicorn-310.exe
352	Unicorn-15421.exe
1252	Unicorn-4861.exe
684	Unicorn-50663.exe
2504	Unicorn-44533.exe
288	Unicorn-8068.exe
556	Unicorn-60798.exe
740	Unicorn-41063.exe
1632	Unicorn-37948.exe
1588	Unicorn-18619.exe
2044	Unicorn-24343.exe
2024	Unicorn-10564.exe
2124	Unicorn-63315.exe
1176	Unicorn-30451.exe
324	Unicorn-59402.exe
1668	Unicorn-59624.exe
2244	Unicorn-46019.exe
2736	Unicorn-19050.exe
2728	Unicorn-12919.exe
2220	Unicorn-18666.exe
2768	Unicorn-64337.exe
2856	Unicorn-12343.exe
3012	Unicorn-1561.exe
2564	Unicorn-17248.exe
1592	Unicorn-2220.exe
1496	Unicorn-20861.exe
1992	Unicorn-2220.exe
2716	Unicorn-48956.exe
2796	Unicorn-29090.exe
2880	Unicorn-48691.exe
572	Unicorn-25721.exe
1112	Unicorn-31852.exe
1384	Unicorn-55779.exe
1656	Unicorn-53149.exe
2144	Unicorn-19635.exe
1908	Unicorn-27746.exe
2380	Unicorn-21484.exe
2224	Unicorn-18146.exe
2100	Unicorn-47612.exe
2972	Unicorn-4955.exe
1156	Unicorn-48982.exe
2628	Unicorn-59917.exe
2488	Unicorn-9781.exe
1684	Unicorn-22204.exe
1732	Unicorn-42070.exe
2992	Unicorn-7487.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2636	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	30
PID 2624 wrote to memory of 2636	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	30
PID 2624 wrote to memory of 2636	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	30
PID 2624 wrote to memory of 2636	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	30
PID 2624 wrote to memory of 2684	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	31
PID 2624 wrote to memory of 2684	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	31
PID 2624 wrote to memory of 2684	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	31
PID 2624 wrote to memory of 2684	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	31
PID 2636 wrote to memory of 2784	2636	Unicorn-27977.exe	32
PID 2636 wrote to memory of 2784	2636	Unicorn-27977.exe	32
PID 2636 wrote to memory of 2784	2636	Unicorn-27977.exe	32
PID 2636 wrote to memory of 2784	2636	Unicorn-27977.exe	32
PID 2784 wrote to memory of 2556	2784	Unicorn-51028.exe	33
PID 2784 wrote to memory of 2556	2784	Unicorn-51028.exe	33
PID 2784 wrote to memory of 2556	2784	Unicorn-51028.exe	33
PID 2784 wrote to memory of 2556	2784	Unicorn-51028.exe	33
PID 2684 wrote to memory of 2588	2684	Unicorn-62958.exe	34
PID 2684 wrote to memory of 2588	2684	Unicorn-62958.exe	34
PID 2684 wrote to memory of 2588	2684	Unicorn-62958.exe	34
PID 2684 wrote to memory of 2588	2684	Unicorn-62958.exe	34
PID 2636 wrote to memory of 2604	2636	Unicorn-27977.exe	35
PID 2636 wrote to memory of 2604	2636	Unicorn-27977.exe	35
PID 2636 wrote to memory of 2604	2636	Unicorn-27977.exe	35
PID 2636 wrote to memory of 2604	2636	Unicorn-27977.exe	35
PID 2624 wrote to memory of 2192	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	36
PID 2624 wrote to memory of 2192	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	36
PID 2624 wrote to memory of 2192	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	36
PID 2624 wrote to memory of 2192	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	36
PID 2556 wrote to memory of 2708	2556	Unicorn-16810.exe	37
PID 2556 wrote to memory of 2708	2556	Unicorn-16810.exe	37
PID 2556 wrote to memory of 2708	2556	Unicorn-16810.exe	37
PID 2556 wrote to memory of 2708	2556	Unicorn-16810.exe	37
PID 2784 wrote to memory of 2916	2784	Unicorn-51028.exe	38
PID 2784 wrote to memory of 2916	2784	Unicorn-51028.exe	38
PID 2784 wrote to memory of 2916	2784	Unicorn-51028.exe	38
PID 2784 wrote to memory of 2916	2784	Unicorn-51028.exe	38
PID 2604 wrote to memory of 1288	2604	Unicorn-10073.exe	39
PID 2604 wrote to memory of 1288	2604	Unicorn-10073.exe	39
PID 2604 wrote to memory of 1288	2604	Unicorn-10073.exe	39
PID 2604 wrote to memory of 1288	2604	Unicorn-10073.exe	39
PID 2636 wrote to memory of 1552	2636	Unicorn-27977.exe	40
PID 2636 wrote to memory of 1552	2636	Unicorn-27977.exe	40
PID 2636 wrote to memory of 1552	2636	Unicorn-27977.exe	40
PID 2636 wrote to memory of 1552	2636	Unicorn-27977.exe	40
PID 2588 wrote to memory of 900	2588	Unicorn-29939.exe	41
PID 2588 wrote to memory of 900	2588	Unicorn-29939.exe	41
PID 2588 wrote to memory of 900	2588	Unicorn-29939.exe	41
PID 2588 wrote to memory of 900	2588	Unicorn-29939.exe	41
PID 2684 wrote to memory of 1056	2684	Unicorn-62958.exe	42
PID 2684 wrote to memory of 1056	2684	Unicorn-62958.exe	42
PID 2684 wrote to memory of 1056	2684	Unicorn-62958.exe	42
PID 2684 wrote to memory of 1056	2684	Unicorn-62958.exe	42
PID 2624 wrote to memory of 1892	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	43
PID 2624 wrote to memory of 1892	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	43
PID 2624 wrote to memory of 1892	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	43
PID 2624 wrote to memory of 1892	2624	b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe	43
PID 2708 wrote to memory of 2132	2708	Unicorn-58278.exe	44
PID 2708 wrote to memory of 2132	2708	Unicorn-58278.exe	44
PID 2708 wrote to memory of 2132	2708	Unicorn-58278.exe	44
PID 2708 wrote to memory of 2132	2708	Unicorn-58278.exe	44
PID 2556 wrote to memory of 2352	2556	Unicorn-16810.exe	45
PID 2556 wrote to memory of 2352	2556	Unicorn-16810.exe	45
PID 2556 wrote to memory of 2352	2556	Unicorn-16810.exe	45
PID 2556 wrote to memory of 2352	2556	Unicorn-16810.exe	45

C:\Users\Admin\AppData\Local\Temp\b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe
"C:\Users\Admin\AppData\Local\Temp\b993685b8a86359315852d2a21e3a28f6dbb7cfb5deae71b308267803fd0f2ca.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27977.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27977.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58278.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
        9⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
        11⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        11⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
        11⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        10⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        10⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        10⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        10⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57200.exe
        9⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        10⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        10⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62679.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51896.exe
        10⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        10⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16481.exe
        9⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        9⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        9⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        9⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        9⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        9⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62982.exe
        9⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38074.exe
        9⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        9⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        9⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10396.exe
        8⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        8⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        8⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
        8⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        8⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22204.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        8⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54647.exe
        9⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42720.exe
        9⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exe
        9⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23607.exe
        8⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        8⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        8⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        8⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        8⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21480.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14680.exe
        8⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27043.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44172.exe
        8⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31719.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62110.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        7⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        7⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16293.exe
        8⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        8⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2721.exe
        8⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        8⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        8⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        8⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        7⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5070.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54896.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        7⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
        6⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57922.exe
        7⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        7⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18653.exe
        6⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50539.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54237.exe
        6⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        6⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42070.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        9⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38074.exe
        9⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        9⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        9⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        9⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29333.exe
        8⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56719.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28811.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        8⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        7⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 180
        9⤵
        Program crash
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        8⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3843.exe
        7⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7487.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
        7⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        7⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        6⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40593.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45569.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42921.exe
        6⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
        7⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36126.exe
        8⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe
        8⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        7⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        6⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41586.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        7⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-681.exe
        6⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39463.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
        6⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        6⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        5⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22785.exe
        6⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13509.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61542.exe
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        6⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17739.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exe
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15952.exe
        5⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        5⤵
        
        PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42968.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        8⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        9⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        9⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        9⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
        9⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe
        9⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        9⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        8⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        8⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        8⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        8⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        8⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        7⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        8⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        8⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        8⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        8⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62587.exe
        8⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12316.exe
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65469.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63231.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20371.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7809.exe
        6⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        7⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23607.exe
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        7⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38009.exe
        6⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        7⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24048.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        6⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
        6⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17248.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
        7⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3481.exe
        7⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        7⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40708.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        6⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
        5⤵
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21184.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25238.exe
        6⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        5⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        5⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
        5⤵
        
        PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        6⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        6⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
        5⤵
        
        PID:484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16097.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53394.exe
        5⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6572.exe
        5⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        5⤵
        
        PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
        5⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        5⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9346.exe
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61542.exe
        5⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        5⤵
        
        PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13010.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
        5⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        5⤵
        
        PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
      4⤵
      PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62912.exe
      4⤵
      PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
      4⤵
      PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30722.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46937.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-310.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        7⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22282.exe
        8⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        8⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
        8⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        8⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43069.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10394.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        7⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
        6⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 240
        7⤵
        Program crash
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38030.exe
        6⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34136.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8991.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15641.exe
        6⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16038.exe
        7⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        7⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5223.exe
        6⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        6⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 180
        7⤵
        Program crash
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        6⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38073.exe
        5⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        6⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        6⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1649.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54093.exe
        5⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        5⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        5⤵
        
        PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
        6⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44160.exe
        7⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        7⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        7⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6424.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        6⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        5⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        6⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 180
        7⤵
        Program crash
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        6⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        5⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45569.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
        5⤵
        
        PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12343.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        5⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64118.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2780.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3924.exe
        5⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        5⤵
        
        PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
      4⤵
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        5⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        5⤵
        
        PID:8788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17238.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63716.exe
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42864.exe
      4⤵
      PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16895.exe
      4⤵
      PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23930.exe
      4⤵
      PID:8952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2597.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24343.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47612.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
        6⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19057.exe
        6⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19127.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        6⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57138.exe
        5⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26530.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17209.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
        5⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10392.exe
        5⤵
        
        PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
        5⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        6⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
        5⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        5⤵
        
        PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exe
      4⤵
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34085.exe
        5⤵
        
        PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
      4⤵
      PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
      4⤵
      PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
      4⤵
      PID:7468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4955.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
        6⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
        6⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31970.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        5⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        5⤵
        
        PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
      4⤵
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40679.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        5⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        5⤵
        
        PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        5⤵
        
        PID:9060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
      4⤵
      PID:8568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59917.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46230.exe
      4⤵
      PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53291.exe
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
      4⤵
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
      4⤵
      PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5894.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
      4⤵
      PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
      4⤵
      PID:9004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
    3⤵
    PID:796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39468.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24147.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
      4⤵
      PID:7600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
      4⤵
      PID:7768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30614.exe
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
    3⤵
    PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
    3⤵
    PID:7032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
    3⤵
    PID:8072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
    3⤵
    PID:8668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62958.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62958.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38074.exe
        8⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-387.exe
        7⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20088.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39471.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61542.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        7⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31898.exe
        6⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63101.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        7⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47288.exe
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39203.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        6⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        6⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        6⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29090.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        6⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16568.exe
        7⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39484.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        7⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
        6⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54896.exe
        6⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        6⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62331.exe
        5⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47552.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        6⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
        6⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51615.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6424.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        5⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
        5⤵
        
        PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20861.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        6⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        7⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        7⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33552.exe
        6⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        6⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        6⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
        5⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        6⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        5⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        5⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
        5⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        5⤵
        
        PID:8452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        6⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        6⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        5⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        5⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        5⤵
        
        PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
      4⤵
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63101.exe
        5⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        5⤵
        
        PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56797.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
      4⤵
      PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
      4⤵
      PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        6⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19132.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28125.exe
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        7⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62587.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26972.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51810.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24724.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
        6⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        6⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        6⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56852.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61222.exe
        5⤵
        
        PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27746.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
        5⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        5⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        5⤵
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        5⤵
        
        PID:8740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35575.exe
      4⤵
      PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22347.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45569.exe
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
      4⤵
      PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
      4⤵
      PID:7456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37948.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
        6⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        6⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
        6⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3904.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26588.exe
        5⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        5⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        5⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        5⤵
        
        PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe
      4⤵
      PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35359.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
        5⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
        5⤵
        
        PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46494.exe
      4⤵
      PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60409.exe
      4⤵
      PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      4⤵
      PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
      4⤵
      PID:8988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45070.exe
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46230.exe
        5⤵
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-135.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
        5⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        5⤵
        
        PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18689.exe
      4⤵
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        5⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39054.exe
        5⤵
        
        PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
      4⤵
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19903.exe
      4⤵
      PID:7824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17613.exe
    3⤵
    PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23969.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
      4⤵
      PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44396.exe
      4⤵
      PID:8552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
    3⤵
    PID:3680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe
    3⤵
    PID:4820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
    3⤵
    PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
    3⤵
    PID:6876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
    3⤵
    PID:7948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
    3⤵
    PID:8860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10056.exe
        5⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61352.exe
        6⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
        6⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
        6⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27262.exe
        5⤵
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40679.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9568.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43039.exe
        6⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        6⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5057.exe
        5⤵
        
        PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
      4⤵
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5894.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        5⤵
        
        PID:8960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31729.exe
      4⤵
      PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2522.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
      4⤵
      PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
      4⤵
      PID:7512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
      4⤵
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        5⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20325.exe
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        6⤵
        
        PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37504.exe
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7309.exe
        5⤵
        
        PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
      4⤵
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23403.exe
        5⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        5⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16481.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21790.exe
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6572.exe
      4⤵
      PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
      4⤵
      PID:7788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
    3⤵
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
      4⤵
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29724.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
      4⤵
      PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe
      4⤵
      PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
      4⤵
      PID:7536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exe
    3⤵
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
    3⤵
    PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51741.exe
    3⤵
    PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
    3⤵
    PID:7544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41063.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40679.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        6⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        6⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43116.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
        5⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        5⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        5⤵
        
        PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60246.exe
      4⤵
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26510.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        5⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        5⤵
        
        PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6572.exe
      4⤵
      PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
      4⤵
      PID:7680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48982.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65503.exe
      4⤵
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        5⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        5⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40058.exe
        5⤵
        
        PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
      4⤵
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
      4⤵
      PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12854.exe
      4⤵
      PID:9040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58607.exe
      4⤵
      PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
      4⤵
      PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
      4⤵
      PID:7700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62110.exe
    3⤵
    PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
    3⤵
    PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
    3⤵
    PID:8088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
    3⤵
    PID:8696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18619.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18619.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48956.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
      4⤵
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19173.exe
        5⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        5⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        5⤵
        
        PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
      4⤵
      PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34136.exe
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
      4⤵
      PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
      4⤵
      PID:8016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
      4⤵
      PID:8796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe
    3⤵
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42980.exe
      4⤵
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
      4⤵
      PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9943.exe
      4⤵
      PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
      4⤵
      PID:8304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31719.exe
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
    3⤵
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
    3⤵
    PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
    3⤵
    PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
    3⤵
    PID:7572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55779.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55779.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
    3⤵
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
      4⤵
      PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
      4⤵
      PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62587.exe
      4⤵
      PID:8648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8357.exe
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
    3⤵
    PID:4244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
    3⤵
    PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47329.exe
    3⤵
    PID:6844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
    3⤵
    PID:7964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
    3⤵
    PID:8900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe
  2⤵
  PID:3056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54415.exe
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
    3⤵
    PID:6448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15586.exe
    3⤵
    PID:7532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
  2⤵
  PID:2232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
  2⤵
  PID:3624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
  2⤵
  PID:4504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
  2⤵
  PID:5436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
  2⤵
  PID:7020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56096.exe
  2⤵
  PID:7956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
  2⤵
  PID:8868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe

Filesize
468KB

MD5
4e1ebc21e2e57b3b7d7f71f66400c8e3

SHA1
2f1554e9506d81f3f236762721e894a95168365f

SHA256
872d92250506f4900ff67b228a0b3c213d30de11bd9f86067f38731432752e8c

SHA512
17a9cfdb3ad54118a5d68317dea7d0f553c834769b0c9851235f8498e0c708451bf95f8c8ac8ba2fddbf63f39fa8aa69940a78a18d9906688c93bddb552ea90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22282.exe

Filesize
468KB

MD5
54bdb15403dd27408e71bf80f0721ac0

SHA1
675f39400b0778799544fc40d1baee5d2a90c981

SHA256
0e5234837974c0f2163df478d9bc69c2e81bbc26618319f01f9fcd0272dec89c

SHA512
b5a03897866ee7eefb607cb6820c3d3d75e98d1c790462bf74e2cd3ef038b36d8d2208f34dacf0f6e4341a4af7e834885c3ed6d537469b19005043a974db801e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-310.exe

Filesize
468KB

MD5
42b15fe3918fe33dc5103e0ca5c49142

SHA1
46ddaaa9f48892f904fd0b35f9a45c92b7aeb83b

SHA256
f459f145aae0539f6dcd02a4525043bc9f030f17be8871e3ab53bd49d0b0cddf

SHA512
d288a613e30dd252ed432df3eab3e316f510f9270fdd0d52fe5696c05e7072e1bf0512311b819cf408e4ff68fadad6c78a6e55e299eb5db71a79c54d000b3121

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe

Filesize
468KB

MD5
d901cd8fbdf42d665e3d3d27b6b0c64e

SHA1
2ab9a05c529f839f96cfd4b85affad97fa3c9e93

SHA256
a87773ca63424dc26688add7d6d1f9682dadab61016e46bde3eed28fd43981eb

SHA512
7194d3975a5348196fb07494c78634123e0d219678d93c192abc80f00f2e7f5df9c36b70c46c2e68b813c4834fc8337fd81dd190d08c9dfd47177a900210a9cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe

Filesize
468KB

MD5
65c6b3ba9c3ec587b79ea92f3107a57e

SHA1
4ad472c45b02a4672eafbd009291c823c9489647

SHA256
c5c302285729822e5982e7466d8107fa62cf0dfb2eecd42dbc891b0a7e9293b3

SHA512
0d50b3f50883800e7ecb3da9f85157d9df4a731a919c4c77f5e955b2159bf2b7500d35d63b62321c4f90305c208d2cb6bd83f9f56a93d97f0034bd90c9b30eea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46937.exe

Filesize
468KB

MD5
0d716c5826370939f34f501d213632ce

SHA1
681974bbe11b13eb07a9f3adf92d58bb519e3c0c

SHA256
00c6f5922012ce3062a490178745862434c9718b4ba83bb6baecddebaea6dcab

SHA512
02359dceab20a0b9b4bef31df43421b6e76ba3f6ae1a445cf066be08cb61ab1f5178bf5c3f4d07334e6047853af5929b9c5dae700c365bc3ac7891590b25a5b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe

Filesize
468KB

MD5
077e895e4812130c5fd774fa6a1c519b

SHA1
98db3671435edf525d25146a56dab2a943ab9ac2

SHA256
ad201861c97689bcd572c080e6b817ab28ec499e3b88c27219a63d608076c794

SHA512
c9c624700aa2ef3756503de576f1feeab4310c13773d23878bc42bb6d56190cbf9bacbfbf7c5730ce2a3f3255d9421afe339fb5c4457a1296189569593b81102

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54647.exe

Filesize
468KB

MD5
16ba27819dc0593802518572127d4c8f

SHA1
bf4a0b72b081d0c04e0fa30f76ec686a324d5f28

SHA256
798db735bbb7ae66751a3dc218d23f62eb5787ce1001dac6bd020e00e357bdbc

SHA512
cc2bf83f82ecb6147a140ecde39ec05133c9302aabb52b625318abfbc42c02c59df71e29dcf88312834ed18f147148403ef213008721c15bd5757752787157f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe

Filesize
468KB

MD5
8a1edd3ad2e75ecd54e6147e386e43c4

SHA1
9e27f372452364d9ecce86c5497c589968a6f1a0

SHA256
c56da72adf17c36f4cbda772cde721b2237951696e86f8d40841c45bbdfa0381

SHA512
ddd2d10fdcd1233991dc6df0821332b547a1772576f5b878ab60a3c62d2204cf1687eb33ab92328e38ca33b0b4dd83d2aecb5e9e7d5ee6e0ddce26a407ba1ae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58278.exe

Filesize
468KB

MD5
084888102aa75bafb737b8e6ec395c2d

SHA1
4a886ce7064d1768b487354060b985b43123d1c8

SHA256
37f5d0249dc5dfe4b3ef9621590f51e62d4a52b11103a01256b0caf5f335465d

SHA512
46ee4d7f3286afc6c6c071cb82a9996666289cf9a1984a1b791a456090818f0631be7cb47c81acb28d34b779cf339adcc0ca572678b5f8309c69838b7fb91e00

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe

Filesize
468KB

MD5
d377005d540fbdb8222a2f7c8bd5c480

SHA1
c18544d468f76fcad3dcfbf4ced44808ad11494d

SHA256
8bae3a5239b24745280507893c445bf1716ef929c6e7ad718fe4960888d8028d

SHA512
1be685236c199c6fee93d8ef80ca031d368fdf85283b5aa107b3af974a2ee3f0d12b8fc9955977a49f19c08cf39ded5e551aa90999f36c90d17e60aea5b7625d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2597.exe

Filesize
468KB

MD5
ddb0237f0a69b7c674a17a65674c364c

SHA1
da73765bc14974dfdfa8c9329817f64d1ca75501

SHA256
79136e7c429c3578da752675f460b93d7ae853f0b71c6fee8d2aa48439b1a73c

SHA512
4a4e182c377fe17b0dd5454d50e13f4dd138899cd2de89d57d70d37f7611d304dc53870846fa0c8bbd34b27bb3886c291e40a674bac93df2252c0ee353becf1e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27977.exe

Filesize
468KB

MD5
af981a470adac2be792e8dd648e12a21

SHA1
17fc3b63ff7ed1fa7d7d73aadfef616a5096f6b6

SHA256
8e70b5af43ccc408ef7b884db7e9eb008f32f756337c056d515a06726a709423

SHA512
5d7abbc6bf3f2c3a8a352b048ae8de53f78eb29cb4a39820c37e21502fc504763e954cbb80061efdcd244bdd9864cf5c7870931c5b1c16c70b79f29a540c95ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe

Filesize
468KB

MD5
0bc4f6aa496f1e9340e9bb394db0da8c

SHA1
0ebff34471485e1f1f6e64229da702a6bd855d18

SHA256
ed7feecdeb63dd55500195eacdde33cb55fca72ffe69af64f5903c6f135ad3d4

SHA512
70a9e2df00fb16cdd521c9c9b7744dadd3118e5b3a2a69b772c2412d7d71766be17db44ad89d9cabf8651b00387d0f6169079a3e04dd0efc9279526829effe76

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe

Filesize
468KB

MD5
b6818d96594c7fd33e50352f4fd0211d

SHA1
81cd79800b51c8a53872d5579d5e48c65cbd435b

SHA256
d3f41666de3944bb65440f211bdb3b11b7c3a6a9881176a699c0e2824ddc4f6a

SHA512
49f077cf837e68a2b176cca5b1a62bf9d230955291a96d4c4772f8befdb04520db0d8d2a9c142a9d527d59e9ec2cf29bc8a25e80a05d2103ac96b7524c3f2598

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe

Filesize
468KB

MD5
645c0b7164a2dcdead479665885d8473

SHA1
d0ae3def4e1ac52f00d0e58de41e6b9c8ecdbcdb

SHA256
b5e6d6a2d22f37c114e6f5a35dde0a381a7eb054c54fc86c1da6eb28d1b9a4f5

SHA512
4682f3875642fe8c9ff4252f24845ac67d57aa535022b7e18e3b0549332d5e11aa43b053f84cd93d7d87fd2abbdccc0185c17756f582da42a52bb7e85f13d818

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe

Filesize
468KB

MD5
35c90b9c0942484c714644adc1876bfd

SHA1
a4c3feda603a1c2579ba2cd7f51f1bb52939168f

SHA256
415fbdb91793ce67d27ba25ab25ee685e24cd0aa2f31c20a01107529eb8a0e2e

SHA512
871926de88eaa0a50d9111f853d2b4cd24ce2f1f9b91f97bcce3abbf60d190169415fcf7a881695621d944b6a313b724fc27b69facaa550311cd0270ab5d2969

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe

Filesize
468KB

MD5
3f0b0cf0684887f6120131b0b6fdab14

SHA1
ffa1d4d87dfffcebb2b472fa66cd82d8b926df85

SHA256
db4a605a821ff0e10c7abec6edd4607ef137d78521caf810f84bf53d9d80293a

SHA512
ba1cf5251dd521544c7e814364b859b116da220b12582a6f5a9f653be1047a686b9b9d3e45ecafe3bcae8a85ad8920da303f05995514f7122416beff9388b077

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe

Filesize
468KB

MD5
50b3b6e870153e847c8517ef10d256ee

SHA1
77c1bf39b8dcd35daf28e603f751928e2a84950d

SHA256
c1f2ac2c94c8aefc189580882bf76ba850d101e212a14c024a7024e2f3bacd07

SHA512
98c022edd6039bcaeb37de9752c19bd9e7c6bb8f55d16d3fe9a4d9eac7dd136838ade370eb7ef931722cba98929ef232a1b176f3740098904b9efaad1a99c876

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe

Filesize
468KB

MD5
f60fdde9d00768f3c70b6b8d61f6740f

SHA1
f70c4ce6244b8407856cb3b9af999f09e16f079e

SHA256
57c02e534293bf5eb77aaa426a94b4e4f6b278569ad2fe4957dacb531fd4bb8b

SHA512
adef4cadbad144bd08086ed264fe096563ba492ba15a3cb2c50fcfd1797a12884ede8141f42c1cbc4651ef5bfd2267d4a5a91d4cca00ef63232f3a51c0f9b5a2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62958.exe

Filesize
468KB

MD5
6d09f7f99f72850f925b5870e2df0594

SHA1
d2e0f2d32875b7f770e81b03f9310cf7763b41b8

SHA256
377b74ef79e67dd7fd07013dae12d2d1cb459e490ff15035fb71b81db0032e5e

SHA512
8df19827f3f4d166fc9b4da20f3cf8eb707f73c3ff9ded087c9803a1606e7f6e76003b8ca48f8ddd309f6d8a2b5a953c289b534999d79e229acac79ccfa54ccd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe

Filesize
468KB

MD5
da4ead813ea53b0754362592a8295318

SHA1
a830479bf11bf4dd2279683021aeb9657a51db12

SHA256
c1dfba41e981116aea7beadc15796023c94db49a30ea4280e62223e69bd95d0a

SHA512
35501179e76b49fba37fce21dd7a7d820cce9aa7da4123354f6b814323e852540fc9a584bb1dd17b6e91a8328f09bb72baa2533fcdae1cd51db85ccfd33d1446

Download Submit