59cb1aaffeba0fef53d749e9def3802734f606fed00f21dbe06b3a1442593e78

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
Size

468KB
MD5

bf0109e28fd9f7ebc88f63d0a46bcf60
SHA1

25317b37739faa41002bf33d337d5c9f4240e1f2
SHA256

59cb1aaffeba0fef53d749e9def3802734f606fed00f21dbe06b3a1442593e78
SHA512

fab26608d891407c69977009bdb71ea5fa8fad0db35f83c4f43e29bb9a192e74a859809d7daa9632de8022b0f813aacea7cd4e1fa62eb355b519c9c97d07f5b6
SSDEEP

3072:p8ACogIdIU57tbY6PzcjYf//sChC7IaYBRHQRV101UHLwO4FwWle:p81oAc7tVP4jYfi/TS1Ur/4Fw

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1932	Unicorn-14657.exe
2608	Unicorn-58679.exe
2796	Unicorn-21176.exe
2532	Unicorn-1160.exe
2552	Unicorn-63360.exe
2576	Unicorn-42193.exe
1644	Unicorn-27894.exe
704	Unicorn-60999.exe
2192	Unicorn-32472.exe
2220	Unicorn-28519.exe
2740	Unicorn-33349.exe
1152	Unicorn-47085.exe
1252	Unicorn-49873.exe
1060	Unicorn-58856.exe
2484	Unicorn-55519.exe
2932	Unicorn-34160.exe
1884	Unicorn-6126.exe
2244	Unicorn-54454.exe
2948	Unicorn-12151.exe
2236	Unicorn-44367.exe
404	Unicorn-44632.exe
1508	Unicorn-52800.exe
3036	Unicorn-62129.exe
540	Unicorn-23806.exe
1608	Unicorn-35504.exe
896	Unicorn-42033.exe
2356	Unicorn-31633.exe
1544	Unicorn-20515.exe
1148	Unicorn-9048.exe
1696	Unicorn-18094.exe
1036	Unicorn-36167.exe
2156	Unicorn-58633.exe
1564	Unicorn-38767.exe
2756	Unicorn-22239.exe
2924	Unicorn-42105.exe
2628	Unicorn-25504.exe
2668	Unicorn-65457.exe
2848	Unicorn-40953.exe
2556	Unicorn-12919.exe
2204	Unicorn-41529.exe
3008	Unicorn-32598.exe
2688	Unicorn-33096.exe
2880	Unicorn-57673.exe
2216	Unicorn-57673.exe
2128	Unicorn-37319.exe
2152	Unicorn-17983.exe
2720	Unicorn-2416.exe
2564	Unicorn-2416.exe
1368	Unicorn-56256.exe
1660	Unicorn-10584.exe
2824	Unicorn-22898.exe
1084	Unicorn-56791.exe
848	Unicorn-48431.exe
2364	Unicorn-28565.exe
2232	Unicorn-32671.exe
2016	Unicorn-32406.exe
2000	Unicorn-44326.exe
1100	Unicorn-64191.exe
1124	Unicorn-55073.exe
692	Unicorn-51809.exe
1520	Unicorn-47170.exe
1716	Unicorn-45561.exe
592	Unicorn-24394.exe
1808	Unicorn-42768.exe

Loads dropped DLL 64 IoCs

pid	Process
2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
1932	Unicorn-14657.exe
2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
1932	Unicorn-14657.exe
2796	Unicorn-21176.exe
2796	Unicorn-21176.exe
1932	Unicorn-14657.exe
1932	Unicorn-14657.exe
2608	Unicorn-58679.exe
2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
2608	Unicorn-58679.exe
2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
2532	Unicorn-1160.exe
2532	Unicorn-1160.exe
2796	Unicorn-21176.exe
2796	Unicorn-21176.exe
2576	Unicorn-42193.exe
2576	Unicorn-42193.exe
2608	Unicorn-58679.exe
1932	Unicorn-14657.exe
2608	Unicorn-58679.exe
1932	Unicorn-14657.exe
2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
704	Unicorn-60999.exe
704	Unicorn-60999.exe
2532	Unicorn-1160.exe
2532	Unicorn-1160.exe
2192	Unicorn-32472.exe
2192	Unicorn-32472.exe
1644	Unicorn-27894.exe
1644	Unicorn-27894.exe
2796	Unicorn-21176.exe
2796	Unicorn-21176.exe
1152	Unicorn-47085.exe
1152	Unicorn-47085.exe
1932	Unicorn-14657.exe
1932	Unicorn-14657.exe
2740	Unicorn-33349.exe
2740	Unicorn-33349.exe
2220	Unicorn-28519.exe
2220	Unicorn-28519.exe
2608	Unicorn-58679.exe
2608	Unicorn-58679.exe
2576	Unicorn-42193.exe
2576	Unicorn-42193.exe
1252	Unicorn-49873.exe
1252	Unicorn-49873.exe
2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
2484	Unicorn-55519.exe
2484	Unicorn-55519.exe
2532	Unicorn-1160.exe
2532	Unicorn-1160.exe
1060	Unicorn-58856.exe
1884	Unicorn-6126.exe
1884	Unicorn-6126.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	2552	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27247.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
1932	Unicorn-14657.exe
2796	Unicorn-21176.exe
2608	Unicorn-58679.exe
2532	Unicorn-1160.exe
2552	Unicorn-63360.exe
2576	Unicorn-42193.exe
1644	Unicorn-27894.exe
704	Unicorn-60999.exe
2192	Unicorn-32472.exe
2220	Unicorn-28519.exe
1152	Unicorn-47085.exe
2740	Unicorn-33349.exe
1252	Unicorn-49873.exe
2484	Unicorn-55519.exe
1060	Unicorn-58856.exe
2932	Unicorn-34160.exe
1884	Unicorn-6126.exe
2244	Unicorn-54454.exe
2948	Unicorn-12151.exe
1508	Unicorn-52800.exe
2236	Unicorn-44367.exe
404	Unicorn-44632.exe
3036	Unicorn-62129.exe
540	Unicorn-23806.exe
1608	Unicorn-35504.exe
896	Unicorn-42033.exe
2356	Unicorn-31633.exe
1544	Unicorn-20515.exe
1148	Unicorn-9048.exe
1696	Unicorn-18094.exe
1036	Unicorn-36167.exe
1564	Unicorn-38767.exe
2156	Unicorn-58633.exe
2756	Unicorn-22239.exe
2924	Unicorn-42105.exe
2628	Unicorn-25504.exe
2668	Unicorn-65457.exe
2848	Unicorn-40953.exe
2556	Unicorn-12919.exe
2204	Unicorn-41529.exe
3008	Unicorn-32598.exe
2216	Unicorn-57673.exe
2880	Unicorn-57673.exe
2128	Unicorn-37319.exe
2688	Unicorn-33096.exe
2152	Unicorn-17983.exe
2720	Unicorn-2416.exe
2564	Unicorn-2416.exe
1660	Unicorn-10584.exe
1368	Unicorn-56256.exe
2824	Unicorn-22898.exe
1084	Unicorn-56791.exe
848	Unicorn-48431.exe
2364	Unicorn-28565.exe
2016	Unicorn-32406.exe
2232	Unicorn-32671.exe
1100	Unicorn-64191.exe
2000	Unicorn-44326.exe
1124	Unicorn-55073.exe
692	Unicorn-51809.exe
1520	Unicorn-47170.exe
1716	Unicorn-45561.exe
592	Unicorn-24394.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1932	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	30
PID 2200 wrote to memory of 1932	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	30
PID 2200 wrote to memory of 1932	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	30
PID 2200 wrote to memory of 1932	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	30
PID 2200 wrote to memory of 2608	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	32
PID 2200 wrote to memory of 2608	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	32
PID 2200 wrote to memory of 2608	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	32
PID 2200 wrote to memory of 2608	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	32
PID 1932 wrote to memory of 2796	1932	Unicorn-14657.exe	31
PID 1932 wrote to memory of 2796	1932	Unicorn-14657.exe	31
PID 1932 wrote to memory of 2796	1932	Unicorn-14657.exe	31
PID 1932 wrote to memory of 2796	1932	Unicorn-14657.exe	31
PID 2796 wrote to memory of 2532	2796	Unicorn-21176.exe	33
PID 2796 wrote to memory of 2532	2796	Unicorn-21176.exe	33
PID 2796 wrote to memory of 2532	2796	Unicorn-21176.exe	33
PID 2796 wrote to memory of 2532	2796	Unicorn-21176.exe	33
PID 1932 wrote to memory of 2552	1932	Unicorn-14657.exe	34
PID 1932 wrote to memory of 2552	1932	Unicorn-14657.exe	34
PID 1932 wrote to memory of 2552	1932	Unicorn-14657.exe	34
PID 1932 wrote to memory of 2552	1932	Unicorn-14657.exe	34
PID 2608 wrote to memory of 2576	2608	Unicorn-58679.exe	35
PID 2608 wrote to memory of 2576	2608	Unicorn-58679.exe	35
PID 2608 wrote to memory of 2576	2608	Unicorn-58679.exe	35
PID 2608 wrote to memory of 2576	2608	Unicorn-58679.exe	35
PID 2200 wrote to memory of 1644	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	36
PID 2200 wrote to memory of 1644	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	36
PID 2200 wrote to memory of 1644	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	36
PID 2200 wrote to memory of 1644	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	36
PID 2532 wrote to memory of 704	2532	Unicorn-1160.exe	37
PID 2532 wrote to memory of 704	2532	Unicorn-1160.exe	37
PID 2532 wrote to memory of 704	2532	Unicorn-1160.exe	37
PID 2532 wrote to memory of 704	2532	Unicorn-1160.exe	37
PID 2796 wrote to memory of 2192	2796	Unicorn-21176.exe	38
PID 2796 wrote to memory of 2192	2796	Unicorn-21176.exe	38
PID 2796 wrote to memory of 2192	2796	Unicorn-21176.exe	38
PID 2796 wrote to memory of 2192	2796	Unicorn-21176.exe	38
PID 2576 wrote to memory of 2220	2576	Unicorn-42193.exe	39
PID 2576 wrote to memory of 2220	2576	Unicorn-42193.exe	39
PID 2576 wrote to memory of 2220	2576	Unicorn-42193.exe	39
PID 2576 wrote to memory of 2220	2576	Unicorn-42193.exe	39
PID 2608 wrote to memory of 2740	2608	Unicorn-58679.exe	40
PID 2608 wrote to memory of 2740	2608	Unicorn-58679.exe	40
PID 2608 wrote to memory of 2740	2608	Unicorn-58679.exe	40
PID 2608 wrote to memory of 2740	2608	Unicorn-58679.exe	40
PID 1932 wrote to memory of 1152	1932	Unicorn-14657.exe	41
PID 1932 wrote to memory of 1152	1932	Unicorn-14657.exe	41
PID 1932 wrote to memory of 1152	1932	Unicorn-14657.exe	41
PID 1932 wrote to memory of 1152	1932	Unicorn-14657.exe	41
PID 2552 wrote to memory of 2492	2552	Unicorn-63360.exe	42
PID 2552 wrote to memory of 2492	2552	Unicorn-63360.exe	42
PID 2552 wrote to memory of 2492	2552	Unicorn-63360.exe	42
PID 2552 wrote to memory of 2492	2552	Unicorn-63360.exe	42
PID 2200 wrote to memory of 1252	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	43
PID 2200 wrote to memory of 1252	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	43
PID 2200 wrote to memory of 1252	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	43
PID 2200 wrote to memory of 1252	2200	bf0109e28fd9f7ebc88f63d0a46bcf60N.exe	43
PID 704 wrote to memory of 1060	704	Unicorn-60999.exe	44
PID 704 wrote to memory of 1060	704	Unicorn-60999.exe	44
PID 704 wrote to memory of 1060	704	Unicorn-60999.exe	44
PID 704 wrote to memory of 1060	704	Unicorn-60999.exe	44
PID 2532 wrote to memory of 2484	2532	Unicorn-1160.exe	45
PID 2532 wrote to memory of 2484	2532	Unicorn-1160.exe	45
PID 2532 wrote to memory of 2484	2532	Unicorn-1160.exe	45
PID 2532 wrote to memory of 2484	2532	Unicorn-1160.exe	45

C:\Users\Admin\AppData\Local\Temp\bf0109e28fd9f7ebc88f63d0a46bcf60N.exe
"C:\Users\Admin\AppData\Local\Temp\bf0109e28fd9f7ebc88f63d0a46bcf60N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60999.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        9⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
        9⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        9⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        9⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
        8⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        8⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        8⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51809.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37435.exe
        8⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3312.exe
        9⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        9⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        9⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        9⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        8⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        8⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        8⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50137.exe
        7⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        8⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        8⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
        7⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        7⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46288.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        8⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16761.exe
        8⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        8⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23903.exe
        7⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47323.exe
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31221.exe
        6⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36169.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55129.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        8⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
        7⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        7⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
        6⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        7⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12516.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
        8⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        8⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe
        8⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        7⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28565.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57118.exe
        7⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        8⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        8⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56524.exe
        7⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        7⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
        6⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        7⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        6⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48431.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46947.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        8⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        8⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        8⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        7⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
        6⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        7⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45388.exe
        6⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30696.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        5⤵
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35812.exe
        5⤵
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34160.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
        8⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        9⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        9⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        9⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63478.exe
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        8⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        8⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5089.exe
        8⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20328.exe
        8⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        8⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        7⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47959.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59550.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        7⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64496.exe
        6⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        6⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22239.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
        7⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        8⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        8⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        7⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        7⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        7⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23188.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7143.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
        6⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55534.exe
        5⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11672.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        6⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54454.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe
        6⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        7⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        7⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-115.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        6⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35057.exe
        5⤵
        
        PID:300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43503.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        5⤵
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        5⤵
        
        PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65042.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        6⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20371.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24471.exe
        5⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-318.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        6⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7804.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57118.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45222.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59280.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20371.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47988.exe
      4⤵
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22386.exe
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62226.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
      4⤵
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27604.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:2492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40953.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37435.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62605.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        6⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        5⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        6⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        5⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12554.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37717.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15461.exe
      4⤵
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22903.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28852.exe
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65457.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36401.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        6⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        5⤵
        
        PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
      4⤵
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        5⤵
        
        PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      4⤵
      PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
      4⤵
      PID:7100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32598.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        5⤵
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10960.exe
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40654.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
      4⤵
      PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48512.exe
    3⤵
    PID:552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5281.exe
      4⤵
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
        5⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
      4⤵
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
      4⤵
      PID:6364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13793.exe
    3⤵
    PID:1344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16070.exe
    3⤵
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
    3⤵
    PID:6684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58679.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42193.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28519.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52800.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10584.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47907.exe
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17807.exe
        8⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        8⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        8⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        8⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exe
        7⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37252.exe
        6⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64295.exe
        7⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4101.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        7⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22898.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        7⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        5⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62331.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22327.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        6⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42342.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        5⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
        6⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        7⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        8⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        8⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        8⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        6⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
        5⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60238.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe
        5⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        6⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        6⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
      4⤵
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe
        5⤵
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        5⤵
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe
      4⤵
      PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
      4⤵
      PID:6852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33349.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe
        7⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        7⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44103.exe
        5⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45388.exe
        5⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
        5⤵
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20371.exe
        5⤵
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30512.exe
      4⤵
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
        5⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        5⤵
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41611.exe
      4⤵
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19384.exe
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
      4⤵
      PID:7108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exe
        7⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        7⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        6⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8519.exe
        5⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        6⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30165.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62091.exe
        5⤵
        
        PID:472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        5⤵
        
        PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38243.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
        5⤵
        
        PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
        5⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7727.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      4⤵
      PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29051.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24093.exe
      4⤵
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
        5⤵
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      4⤵
      PID:6584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47534.exe
    3⤵
    PID:528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
      4⤵
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-431.exe
    3⤵
    PID:3816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
    3⤵
    PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
    3⤵
    PID:6692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18094.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32671.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        6⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42950.exe
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54891.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35263.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23463.exe
        5⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        5⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12143.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47335.exe
      4⤵
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        5⤵
        
        PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
      4⤵
      PID:6804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41798.exe
      4⤵
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        5⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-517.exe
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
      4⤵
      PID:6760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
      4⤵
      PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
      4⤵
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
      4⤵
      PID:6940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9597.exe
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
    3⤵
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
    3⤵
    PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35812.exe
    3⤵
    PID:6708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49873.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49873.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35504.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25245.exe
        5⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        6⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        6⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25278.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        5⤵
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
      4⤵
      PID:6752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42768.exe
    3⤵
    - Executes dropped EXE
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4513.exe
      4⤵
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20328.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38650.exe
      4⤵
      PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
      4⤵
      PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
    3⤵
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
      4⤵
      PID:6420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
    3⤵
    PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28852.exe
    3⤵
    PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57343.exe
    3⤵
    PID:6788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42033.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42033.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
      4⤵
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        5⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        5⤵
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8096.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
      4⤵
      PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
    3⤵
    PID:560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57118.exe
      4⤵
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55129.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59613.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63478.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
    3⤵
    PID:656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
      4⤵
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
      4⤵
      PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
      4⤵
      PID:6924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
    3⤵
    PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62695.exe
    3⤵
    PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33202.exe
    3⤵
    PID:6436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56464.exe
    3⤵
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3618.exe
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
      4⤵
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
      4⤵
      PID:6604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
    3⤵
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
    3⤵
    PID:6716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
    3⤵
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52870.exe
    3⤵
    PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
    3⤵
    PID:6916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
  2⤵
  PID:3944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
  2⤵
  PID:5312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6941.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6941.exe
  2⤵
  PID:6512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12143.exe

Filesize
468KB

MD5
f7958b5b6507bfe035529543fd32d8ff

SHA1
5f03f9f7de1c11c457a37f66e2c4c5977e93297a

SHA256
1e1ea61a19f06abce1963efdbf6f3a5ff1c7d4ca885f0e89495f57d0ebca807e

SHA512
12fe703f967537fe730727487777e07c4d572e74fdfb9abd77b6de5f1189fc4b2b9f986c3233de6fdccac83534cf8e3e95192a360c782e38d1ab3bbc669fb778

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe

Filesize
468KB

MD5
8790b4a8da9d4d2be524812debef93f6

SHA1
101e7f60ca6fffd13e2b623cffdaaa9e58c4cd5d

SHA256
4804cba6da2ec196700e30ae8b402e0436dcd31942bebefc15cfae9ff63ac318

SHA512
a7358923acd5541d7f29dd2968e96ddfbe2acbdd83ada668854a586a9c975d6076a936067363d51311037a27f56850acc32449ad3a30c1126faaa83c02369274

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28519.exe

Filesize
468KB

MD5
4c52ae17974530016ff9c92703bb6e5a

SHA1
c910d8c393cd44901e1322d6a75040aef7f9edb7

SHA256
b1f3cb82d559faec0477ff64a54336e189fd0aa0fba6b6baff8794f1266edb4f

SHA512
7a1b1214a2d9bf96a6b65ad4d755b8485fa2df6db98f2f4071f946b1aae7e1981e398a1f8e2954ad369944f6a3800c078546b9ac3f4fd884d85a45267dc9e973

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33349.exe

Filesize
468KB

MD5
eb4f31e12d1837540194e668d0b35807

SHA1
1920560c6300394f8227fba2ded46fd23bf93840

SHA256
36584858a7c2911fdaaf46afe27a06daa8a877f174c8ee5719901ae69caba835

SHA512
b67a9f1bb9b256eda9318792cb97459784d79caac47aedbd43fd36fca248a6335f792c1ffaa5a7e7fa2dda9d033d20fda4ad3bbcd6ec0e22c647043bbc38a7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37888.exe

Filesize
468KB

MD5
a9eec45575fb93b8f587f8e56ce13133

SHA1
334b267e5b96ddc2e0234634edb11bac65ce2f97

SHA256
b6c4f7d98574c07d5e38e6bf4d06107499eeb3447c7d6d9da67d2af48df3258a

SHA512
6f63438ef5e1400220f8b0e3a86903d2974934059e306a75e3a1c16f14e60461bdaf9d4d6cd1a529ce765c36cd052a43b96750b0c7d62854838e3ff9a2c703bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe

Filesize
468KB

MD5
430b9c1233e1de83b3b9b0d5fdbff6e1

SHA1
a5dcffaf59fb957035fc18386f2485d7b260a8fb

SHA256
2c67f2c92b09a947af66b2205e541ffe162303af1246ab87e4f46a947ef224d9

SHA512
e8247d2211dc92a7a240711002a454d516eb37a1ea2458536c89dc240c42d239f3c1eca6c3f4f1412bfb62a5534e5b7a4125d157d7e18b644bc6aab8073666bb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe

Filesize
468KB

MD5
eef0f04dd32e955ac316b987c891e9dd

SHA1
efeebb3a7635361f6c738433146da101df871061

SHA256
4839d9e00f291fcd3fe8dd8e19079f9ac134ceac76029ee07cd0d9b1c1053bc3

SHA512
090dc04d19332a426c1a61a134110c21f14952b006e50ad298249aae691310f1aedd3ca41697bde97cdba9a6e847175d38140cca632a55816d4bb8db373f49c6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe

Filesize
468KB

MD5
91cc2275b054e9ac220728937291f145

SHA1
197cf0dfe196e8869f95c3f61a86a99319c43599

SHA256
44084a5ede869367777f9767b5f5d0b47ec4bcd80e36fed7485b6439a5c35740

SHA512
053662b00a166a4608b66c290317f592293bcf73d58b5c08a81bda0c1c2eacd9933f76733cad3145edb0780940c03cde0974e8f2b8ae34ec180ed8bae88a846d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe

Filesize
468KB

MD5
f60d2cf8303031a0a63aa317e45c02e9

SHA1
442b10a3f09adef1647844616ad0a5abf1d29b1f

SHA256
bdbaff3646bad7df8512f9ff6069360323431c12590080f4c371d8cc0a1660d1

SHA512
ed741af458218d7b1b479a8e545a8777c0389ecf04de2a20317812fdddb8de2730d3fe85b15ffe1697b2f887199ba8391fefd7785a5ec00aa2c9121720107ca0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe

Filesize
468KB

MD5
625760f2db5a9afd490abe3a89493a27

SHA1
ff193a067dce4467ba602c741c1536d13789ccb5

SHA256
76077aaa3c842a6f31f3489d124feeee67e81fb169c56fda8b841fb200500557

SHA512
80d4a6ac6679b288999c1457b11205bd583683acdb6258f03c663eccfc14a6861ce81100d2634180f197369baf6c707be171afae232217be7d52622411f88b7a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe

Filesize
468KB

MD5
1a5753f879dbe82ecca944daebfefa9f

SHA1
5df5dd36670bb28d48af4bc99a05e114015a56f7

SHA256
0a79b11d1e36cf15c5fc992891df00c989312c4c0a3a7abf2578b759421e9d04

SHA512
27d27ffa581aed94b748e00e7604b90b6f0230bd6869159b4fdb82ecbbd0413053e4b1a1fbf6bbe9a0c6fe84c600372b29214954b76025fa2fa50dc25debd6b8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34160.exe

Filesize
468KB

MD5
713be350714de65951f23a228fcbc0b6

SHA1
ec7107adef765cacca2407881a769d430882bf7b

SHA256
04052d5ec990d2e938a30b5350c901de49a5dbe87656d4d504d7effa5c8ed5bc

SHA512
8bd47f9e5fc7f4a3f9d913e616988fad6933726e86f29a028fd543365c1ab6a1b74a16384e2c35dbca01f7694be8609d9603d2588fad10684621510983e23c22

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42193.exe

Filesize
468KB

MD5
53e02a4792572d7880fe5f3a9e2fc5db

SHA1
d21d10d9d4ac09fba2c9d60af463f665d668b489

SHA256
2d44d84e14d5261bd598d62c2790cf4f71cee00528c232cb277c91c4be941e9b

SHA512
96d18f8819ff7fcb3cd9be1b8115c3ddf4bbc407e5e7b7f1ca6eacdc7bd6fb81ab93cdd31008c1cc997ed387342262c62390e076b4aa63da8ca33770feb8747d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe

Filesize
468KB

MD5
51243ed1809be76a4eb16e004c10826c

SHA1
7e118da4ad3888f7d4a6d26190cc8973029df4db

SHA256
308f1457f801ea7c9e0f495cf7853e2d1e565ad7b6689daa37cfc00dc50395de

SHA512
69af6d9773adb79c33c8ca2c516fa48a5fccba285e1c042236a1d7b0b9d9ef9882f83b607c7d72af674a55127e5e0ee4e1d2ba68c8426609b23277790177f4c6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49873.exe

Filesize
468KB

MD5
a0ecb1b7254465e7fb9ccfad35d479b3

SHA1
d5fab5883aa7acfd4ff8cac47f53be3a02d7216e

SHA256
f40e13709d95f7f95d31a51bd9d6c7e60d02f8fe2ae9524d374fd908027a971d

SHA512
8563dc04e2b8fadf0056ced897522cbad475e71677d326abf6f1fb700f05946914f4cd56331b341657dd037f10ba985b26775c67fa1b77400f20234af4fa662d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe

Filesize
468KB

MD5
92b70ee95d1e04d535dbbc1f44d782fc

SHA1
2ea6c2aebdcd19617ea207ce3955d2570f44de13

SHA256
871b1a4d2073b8b667725f3fd6f692ecb582a94e6ec5c74f63aa712e7a286883

SHA512
aae471964389928e960361d8f0a4c92a9315f40ee44250a8897a55760dd07476fa9cfd68b931833d83ed7cb9e380d854a14354a2c5c87ddfcf9864bdda014b9b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58679.exe

Filesize
468KB

MD5
3faf441fb972c80caffe8e34dc48a572

SHA1
89e4523e34fe11fec9782f6cc2efe9af06e77f14

SHA256
f9ea2ec7196fb4cb05477e2a87c73664935fdfef94ac9af758aea82adc276b64

SHA512
97fa0cbf469168d14141ed0eb427c5b8a4b0326db0560593a4a31f4eadabfd5f8647a03be8825bc355c7ef8a2fd16e83e79f3009eb1b95a1780c6099e907486f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe

Filesize
468KB

MD5
69d9506f64c17a5cac747dd5a543fa8b

SHA1
dfac730a59742715750a6ef6f509a1fa39b37683

SHA256
8a7daefe8acf20045de3b02fd3996102e0965aa9f4ed472644eaf00cc30d4a29

SHA512
fdb87aaa7da593c1875ea71a41829be9189a1c9b376020a6c9a9d92d0ce7da558e3fd42cd83b5bceb1dbcef34ce167d7c3b3ad9978533da33ab0a6a849474fa9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60999.exe

Filesize
468KB

MD5
680faa2eee1f7fe4b669785bf96c4fe2

SHA1
c662171dfa15d2ebb4033ebdf77e1df43087ad0d

SHA256
8381162e3930d3e46106f452219b7106165b0ff5b86bec0236119f66d028c84c

SHA512
91094db4f23ef0bd84c71559f2d63bd67af77d4c32925fe851183f930181f4f3b858b9d0e4c2ba92c7e6e1ee62617edf16206acbe0b4832cbca05e8ac8e57895

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe

Filesize
468KB

MD5
4a14aed75d2417200c8e8218b6f21539

SHA1
21315455aee947ea17eb14efe8904c4a3d592007

SHA256
08326d81d50aee2e97c0a0495abc0e346373cb9989ba5d506dbe5a91412ab221

SHA512
1c9fb4abe692313e7cf000714db8288c2ec8b37bdbe832fb8a7b6465513cdb4469ddc17eaaad50227ada736a69835c3d8b3034b002a56bd1b5cbc71301dcfc5d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe

Filesize
468KB

MD5
e9f0621e6d1f118d22e7949c32da12c0

SHA1
e2ef372bfdb2c3350e660c72ce37df3e967580df

SHA256
5fb0a991be03b906250916da396d641ab9e3feb155964ef8b58ec4c7655c036c

SHA512
460b00bb1f184b546c33aa6707683cba7398a50a7d622397d2b6557a980d6cfcfe881e2a6db23c51325a7badcacf6a9efdca8c853626695a92492f81d5f9d95a

Download Submit