01b2ca62d516f2c912bcace4ec63182d476046f5f8dd3a295c224d3b6416a3ba

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fba86cc8dadb0402a3e80d6b24ed29f0N.exe
Size

468KB
MD5

fba86cc8dadb0402a3e80d6b24ed29f0
SHA1

64f2ccf1fcf47f560278a1e0c70a9b303ea77dd9
SHA256

01b2ca62d516f2c912bcace4ec63182d476046f5f8dd3a295c224d3b6416a3ba
SHA512

a268099be6e996c5d0ed030efa48d4d6b126f5367f453978cf166033e118ee97ade6fcaae4649fece64de35e18f620cb1f4dcd76c0431cf8a4f352bd2f674c70
SSDEEP

3072:q1CaovUuU35n3bYAPgtZOf8/E5RhDiXzHmHdxS+KU1Swq1WueElD:q1PoCJn3LPMZOfF46qU13iWue

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2164	Unicorn-5529.exe
2748	Unicorn-64559.exe
2956	Unicorn-14709.exe
2764	Unicorn-40718.exe
2812	Unicorn-28104.exe
1088	Unicorn-60584.exe
2832	Unicorn-21781.exe
2904	Unicorn-21213.exe
636	Unicorn-21213.exe
2856	Unicorn-15082.exe
2920	Unicorn-21213.exe
592	Unicorn-21213.exe
2608	Unicorn-1347.exe
2000	Unicorn-7408.exe
2200	Unicorn-57812.exe
1356	Unicorn-14933.exe
580	Unicorn-30501.exe
2768	Unicorn-3662.exe
2088	Unicorn-61146.exe
2976	Unicorn-4539.exe
2092	Unicorn-53548.exe
2132	Unicorn-47418.exe
2588	Unicorn-53548.exe
2368	Unicorn-53548.exe
676	Unicorn-17154.exe
1072	Unicorn-48566.exe
1980	Unicorn-33298.exe
2488	Unicorn-19423.exe
1696	Unicorn-36371.exe
1688	Unicorn-61672.exe
1964	Unicorn-61023.exe
2468	Unicorn-27547.exe
1084	Unicorn-41038.exe
2188	Unicorn-63208.exe
876	Unicorn-21390.exe
2464	Unicorn-30152.exe
1588	Unicorn-6695.exe
2320	Unicorn-48.exe
2656	Unicorn-28999.exe
2752	Unicorn-48865.exe
2776	Unicorn-10747.exe
2672	Unicorn-48673.exe
2712	Unicorn-32337.exe
3032	Unicorn-29492.exe
2432	Unicorn-18990.exe
1912	Unicorn-18724.exe
2716	Unicorn-18990.exe
1488	Unicorn-59061.exe
2020	Unicorn-35518.exe
2072	Unicorn-47941.exe
2288	Unicorn-28397.exe
1292	Unicorn-28619.exe
1076	Unicorn-34750.exe
1112	Unicorn-34750.exe
1568	Unicorn-55093.exe
264	Unicorn-4381.exe
480	Unicorn-660.exe
288	Unicorn-44053.exe
1692	Unicorn-22685.exe
2304	Unicorn-51828.exe
2388	Unicorn-41652.exe
1152	Unicorn-32337.exe
832	Unicorn-38253.exe
756	Unicorn-37219.exe

Loads dropped DLL 64 IoCs

pid	Process
2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe
2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe
2164	Unicorn-5529.exe
2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe
2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe
2164	Unicorn-5529.exe
2748	Unicorn-64559.exe
2956	Unicorn-14709.exe
2164	Unicorn-5529.exe
2956	Unicorn-14709.exe
2748	Unicorn-64559.exe
2164	Unicorn-5529.exe
2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe
2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe
2832	Unicorn-21781.exe
2812	Unicorn-28104.exe
2812	Unicorn-28104.exe
2832	Unicorn-21781.exe
2764	Unicorn-40718.exe
1088	Unicorn-60584.exe
2164	Unicorn-5529.exe
2764	Unicorn-40718.exe
2164	Unicorn-5529.exe
1088	Unicorn-60584.exe
2956	Unicorn-14709.exe
2956	Unicorn-14709.exe
2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe
2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe
2748	Unicorn-64559.exe
2748	Unicorn-64559.exe
2904	Unicorn-21213.exe
2904	Unicorn-21213.exe
2832	Unicorn-21781.exe
2832	Unicorn-21781.exe
2000	Unicorn-7408.exe
2000	Unicorn-7408.exe
2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe
2608	Unicorn-1347.exe
2608	Unicorn-1347.exe
2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe
2956	Unicorn-14709.exe
636	Unicorn-21213.exe
2920	Unicorn-21213.exe
592	Unicorn-21213.exe
2956	Unicorn-14709.exe
636	Unicorn-21213.exe
2920	Unicorn-21213.exe
592	Unicorn-21213.exe
2812	Unicorn-28104.exe
2812	Unicorn-28104.exe
2764	Unicorn-40718.exe
2764	Unicorn-40718.exe
1088	Unicorn-60584.exe
1088	Unicorn-60584.exe
2856	Unicorn-15082.exe
2856	Unicorn-15082.exe
2164	Unicorn-5529.exe
2164	Unicorn-5529.exe
2200	Unicorn-57812.exe
2200	Unicorn-57812.exe
1356	Unicorn-14933.exe
2748	Unicorn-64559.exe
1356	Unicorn-14933.exe
2748	Unicorn-64559.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2420	2416	WerFault.exe	96
3612	692	WerFault.exe	127

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53338.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe
2164	Unicorn-5529.exe
2748	Unicorn-64559.exe
2956	Unicorn-14709.exe
2764	Unicorn-40718.exe
1088	Unicorn-60584.exe
2812	Unicorn-28104.exe
2832	Unicorn-21781.exe
2904	Unicorn-21213.exe
636	Unicorn-21213.exe
2000	Unicorn-7408.exe
2856	Unicorn-15082.exe
2920	Unicorn-21213.exe
592	Unicorn-21213.exe
2608	Unicorn-1347.exe
2200	Unicorn-57812.exe
1356	Unicorn-14933.exe
580	Unicorn-30501.exe
2768	Unicorn-3662.exe
2088	Unicorn-61146.exe
2092	Unicorn-53548.exe
2976	Unicorn-4539.exe
2588	Unicorn-53548.exe
2132	Unicorn-47418.exe
2368	Unicorn-53548.exe
676	Unicorn-17154.exe
1072	Unicorn-48566.exe
1980	Unicorn-33298.exe
2488	Unicorn-19423.exe
1696	Unicorn-36371.exe
1688	Unicorn-61672.exe
1964	Unicorn-61023.exe
2468	Unicorn-27547.exe
1084	Unicorn-41038.exe
2188	Unicorn-63208.exe
876	Unicorn-21390.exe
2464	Unicorn-30152.exe
1588	Unicorn-6695.exe
2320	Unicorn-48.exe
2752	Unicorn-48865.exe
2656	Unicorn-28999.exe
2776	Unicorn-10747.exe
2672	Unicorn-48673.exe
2712	Unicorn-32337.exe
3032	Unicorn-29492.exe
1912	Unicorn-18724.exe
2432	Unicorn-18990.exe
2716	Unicorn-18990.exe
1488	Unicorn-59061.exe
2020	Unicorn-35518.exe
2288	Unicorn-28397.exe
2072	Unicorn-47941.exe
1292	Unicorn-28619.exe
1076	Unicorn-34750.exe
1112	Unicorn-34750.exe
1568	Unicorn-55093.exe
264	Unicorn-4381.exe
480	Unicorn-660.exe
288	Unicorn-44053.exe
1692	Unicorn-22685.exe
2304	Unicorn-51828.exe
1152	Unicorn-32337.exe
2388	Unicorn-41652.exe
832	Unicorn-38253.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2164	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	31
PID 2932 wrote to memory of 2164	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	31
PID 2932 wrote to memory of 2164	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	31
PID 2932 wrote to memory of 2164	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	31
PID 2932 wrote to memory of 2956	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	33
PID 2932 wrote to memory of 2956	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	33
PID 2932 wrote to memory of 2956	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	33
PID 2932 wrote to memory of 2956	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	33
PID 2164 wrote to memory of 2748	2164	Unicorn-5529.exe	32
PID 2164 wrote to memory of 2748	2164	Unicorn-5529.exe	32
PID 2164 wrote to memory of 2748	2164	Unicorn-5529.exe	32
PID 2164 wrote to memory of 2748	2164	Unicorn-5529.exe	32
PID 2956 wrote to memory of 1088	2956	Unicorn-14709.exe	35
PID 2956 wrote to memory of 1088	2956	Unicorn-14709.exe	35
PID 2956 wrote to memory of 1088	2956	Unicorn-14709.exe	35
PID 2956 wrote to memory of 1088	2956	Unicorn-14709.exe	35
PID 2748 wrote to memory of 2812	2748	Unicorn-64559.exe	34
PID 2748 wrote to memory of 2812	2748	Unicorn-64559.exe	34
PID 2748 wrote to memory of 2812	2748	Unicorn-64559.exe	34
PID 2748 wrote to memory of 2812	2748	Unicorn-64559.exe	34
PID 2164 wrote to memory of 2764	2164	Unicorn-5529.exe	36
PID 2164 wrote to memory of 2764	2164	Unicorn-5529.exe	36
PID 2164 wrote to memory of 2764	2164	Unicorn-5529.exe	36
PID 2164 wrote to memory of 2764	2164	Unicorn-5529.exe	36
PID 2932 wrote to memory of 2832	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	37
PID 2932 wrote to memory of 2832	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	37
PID 2932 wrote to memory of 2832	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	37
PID 2932 wrote to memory of 2832	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	37
PID 2812 wrote to memory of 2920	2812	Unicorn-28104.exe	39
PID 2812 wrote to memory of 2920	2812	Unicorn-28104.exe	39
PID 2812 wrote to memory of 2920	2812	Unicorn-28104.exe	39
PID 2812 wrote to memory of 2920	2812	Unicorn-28104.exe	39
PID 2832 wrote to memory of 2904	2832	Unicorn-21781.exe	38
PID 2832 wrote to memory of 2904	2832	Unicorn-21781.exe	38
PID 2832 wrote to memory of 2904	2832	Unicorn-21781.exe	38
PID 2832 wrote to memory of 2904	2832	Unicorn-21781.exe	38
PID 2764 wrote to memory of 636	2764	Unicorn-40718.exe	40
PID 2764 wrote to memory of 636	2764	Unicorn-40718.exe	40
PID 2764 wrote to memory of 636	2764	Unicorn-40718.exe	40
PID 2764 wrote to memory of 636	2764	Unicorn-40718.exe	40
PID 2164 wrote to memory of 2856	2164	Unicorn-5529.exe	42
PID 2164 wrote to memory of 2856	2164	Unicorn-5529.exe	42
PID 2164 wrote to memory of 2856	2164	Unicorn-5529.exe	42
PID 2164 wrote to memory of 2856	2164	Unicorn-5529.exe	42
PID 1088 wrote to memory of 592	1088	Unicorn-60584.exe	41
PID 1088 wrote to memory of 592	1088	Unicorn-60584.exe	41
PID 1088 wrote to memory of 592	1088	Unicorn-60584.exe	41
PID 1088 wrote to memory of 592	1088	Unicorn-60584.exe	41
PID 2956 wrote to memory of 2608	2956	Unicorn-14709.exe	43
PID 2956 wrote to memory of 2608	2956	Unicorn-14709.exe	43
PID 2956 wrote to memory of 2608	2956	Unicorn-14709.exe	43
PID 2956 wrote to memory of 2608	2956	Unicorn-14709.exe	43
PID 2932 wrote to memory of 2000	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	44
PID 2932 wrote to memory of 2000	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	44
PID 2932 wrote to memory of 2000	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	44
PID 2932 wrote to memory of 2000	2932	fba86cc8dadb0402a3e80d6b24ed29f0N.exe	44
PID 2748 wrote to memory of 2200	2748	Unicorn-64559.exe	45
PID 2748 wrote to memory of 2200	2748	Unicorn-64559.exe	45
PID 2748 wrote to memory of 2200	2748	Unicorn-64559.exe	45
PID 2748 wrote to memory of 2200	2748	Unicorn-64559.exe	45
PID 2904 wrote to memory of 1356	2904	Unicorn-21213.exe	46
PID 2904 wrote to memory of 1356	2904	Unicorn-21213.exe	46
PID 2904 wrote to memory of 1356	2904	Unicorn-21213.exe	46
PID 2904 wrote to memory of 1356	2904	Unicorn-21213.exe	46

C:\Users\Admin\AppData\Local\Temp\fba86cc8dadb0402a3e80d6b24ed29f0N.exe
"C:\Users\Admin\AppData\Local\Temp\fba86cc8dadb0402a3e80d6b24ed29f0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
        8⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        9⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
        9⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        8⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        8⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59991.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44146.exe
        8⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65243.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        8⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29372.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34605.exe
        7⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
        7⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        8⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        7⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        7⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60421.exe
        6⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        7⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        6⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
        7⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
        7⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        6⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        7⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        7⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        6⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51670.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28619.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
        6⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21703.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        7⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62325.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        7⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5736.exe
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51382.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        5⤵
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11994.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14461.exe
        7⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12974.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
        6⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        6⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        5⤵
        
        PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2423.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21908.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57812.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13010.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exe
        7⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe
        6⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41567.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        6⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
        6⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        7⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37785.exe
        5⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
        5⤵
        
        PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        7⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42544.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        6⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64558.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52889.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        5⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10013.exe
        5⤵
        
        PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4771.exe
        5⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28733.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
        5⤵
        
        PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31843.exe
      4⤵
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        5⤵
        
        PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
      4⤵
      PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40718.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60842.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        8⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54943.exe
        8⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42109.exe
        8⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exe
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        7⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        7⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17059.exe
        7⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8418.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31040.exe
        6⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36695.exe
        7⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63608.exe
        7⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23671.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36283.exe
        6⤵
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50895.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        6⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        7⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3819.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
        5⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        6⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        6⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        5⤵
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
        5⤵
        
        PID:596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        6⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
        5⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe
        5⤵
        
        PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
      4⤵
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
        5⤵
        
        PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5239.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
      4⤵
      PID:7548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15082.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19423.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17412.exe
        6⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37790.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        7⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        6⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55378.exe
        5⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        6⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37790.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        5⤵
        
        PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28397.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
        5⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65023.exe
        6⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16276.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27003.exe
        5⤵
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
      4⤵
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18838.exe
        5⤵
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29694.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19916.exe
      4⤵
      PID:268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
      4⤵
      PID:6304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20677.exe
        5⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37022.exe
        6⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19434.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15512.exe
        5⤵
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35517.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
      4⤵
      PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55093.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
      4⤵
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
      4⤵
      PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
    3⤵
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13145.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
      4⤵
      PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
      4⤵
      PID:7944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
    3⤵
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
    3⤵
    PID:840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13423.exe
    3⤵
    PID:6964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60584.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
        6⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        7⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
        8⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35238.exe
        7⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1701.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64646.exe
        6⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31438.exe
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        7⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26974.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exe
        5⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52263.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31775.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        5⤵
        
        PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4381.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63961.exe
        6⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
        7⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34637.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        7⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53731.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
        6⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42909.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63421.exe
        5⤵
        
        PID:692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 216
        6⤵
        Program crash
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48409.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        5⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27610.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
        5⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
        6⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5736.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18709.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
      4⤵
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48553.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44210.exe
      4⤵
      PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54522.exe
      4⤵
      PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
      4⤵
      PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
      4⤵
      PID:7564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4539.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16265.exe
        7⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
        7⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5267.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61635.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17854.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        6⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36283.exe
        6⤵
        
        PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47010.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47974.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
        6⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        6⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23671.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27003.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
      4⤵
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        5⤵
        
        PID:464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43726.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        5⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        5⤵
        
        PID:7976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
      4⤵
      PID:808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2078.exe
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47418.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5070.exe
        6⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2541.exe
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        6⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37970.exe
        5⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        5⤵
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
      4⤵
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1893.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
      4⤵
      PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53349.exe
      4⤵
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34713.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
      4⤵
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34221.exe
      4⤵
      PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37423.exe
    3⤵
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
      4⤵
      PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
    3⤵
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
      4⤵
      PID:7480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
    3⤵
    PID:3560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
    3⤵
    PID:5892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-237.exe
    3⤵
    PID:6660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14933.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38253.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57068.exe
        7⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36749.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        7⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45158.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        5⤵
        Executes dropped EXE
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        5⤵
        
        PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2469.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        5⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        6⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48674.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30417.exe
        7⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        6⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        6⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exe
      4⤵
      PID:2416
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 216
        5⤵
        Program crash
        
        PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
      4⤵
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33514.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
      4⤵
      PID:7116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7884.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58386.exe
        6⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52387.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        5⤵
        
        PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
      4⤵
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
        5⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
        5⤵
        
        PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
      4⤵
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7779.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29696.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe
        5⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        5⤵
        
        PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
      4⤵
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
      4⤵
      PID:2328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57194.exe
      4⤵
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5347.exe
        5⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe
      4⤵
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38909.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13097.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exe
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
      4⤵
      PID:7280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
    3⤵
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36100.exe
      4⤵
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18493.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65501.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59991.exe
      4⤵
      PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
    3⤵
    PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33774.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18210.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        5⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        6⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48402.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35238.exe
        7⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        6⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40598.exe
        5⤵
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        6⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
      4⤵
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41858.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51322.exe
      4⤵
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        5⤵
        
        PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
      4⤵
      PID:7556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6695.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26826.exe
      4⤵
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        5⤵
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        6⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
        6⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
        6⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
      4⤵
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16561.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13097.exe
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34989.exe
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43754.exe
      4⤵
      PID:7184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49969.exe
    3⤵
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-254.exe
      4⤵
      PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60504.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
      4⤵
      PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6834.exe
    3⤵
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57900.exe
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50895.exe
    3⤵
    PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
    3⤵
    PID:6372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        5⤵
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23287.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27003.exe
      4⤵
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
    3⤵
    PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
      4⤵
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35238.exe
      4⤵
      PID:6596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8037.exe
    3⤵
    PID:3528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
    3⤵
    PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
    3⤵
    PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
    3⤵
    PID:6608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
    3⤵
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29051.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
      4⤵
      PID:6384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46666.exe
    3⤵
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
    3⤵
    PID:6540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42109.exe
    3⤵
    PID:7524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5208.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5208.exe
  2⤵
  PID:1572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16280.exe
    3⤵
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
    3⤵
    PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
    3⤵
    PID:6168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
    3⤵
    PID:6536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
  2⤵
  PID:3392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
  2⤵
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45294.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45294.exe
  2⤵
  PID:5684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
  2⤵
  PID:6524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe

Filesize
468KB

MD5
3a45e9e8c3a027a1d300427ce5caaf0e

SHA1
31b6959a510e4d242303794769e7431aebb12639

SHA256
276a2c5fbf8672c64e90b807914b55517f847ac4bb0d481961cfe9e763428a29

SHA512
bbffba5a0499255254de3c11767d7579012b4ec0ba5afeca3485129f5a8724512092b7772b55e27889f99c59d3c4d04973c04f71aedea41ed47cb77de840456a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe

Filesize
468KB

MD5
0cfebc2a85b3531e51bcff298725e999

SHA1
204e0ec49aec01dfd6368a291dbb51c7caacafee

SHA256
112023531fb28a1a01656f9abc07dcb3abdcc24b66012ed57a54cf52f6db46b7

SHA512
1bc6e330fa28e2b8bea68af6670822d6b607b6d0b3c152cc35cb0d719535222f31f4225438631bf2f07f73d3a26b8d966a3dc686521377467ff8649a2a8ba1d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14933.exe

Filesize
468KB

MD5
864c74d1ebba7b2bca1bd0a490a686e1

SHA1
04817f56284a38b08b37a0024bba4fa85716ea36

SHA256
c15d8a923f41618b4fd70382b15cea73705eec948a27d2893f62bd2d6a863c0b

SHA512
10cb48b66c449af2956ebe0a05df223a5006d13e2b309d42f0ed49eaaf7dcd20bfaf335c3c88200e29f2d93919bab1ed8ac709ec7a0b659d423ceb34766dd220

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe

Filesize
468KB

MD5
a5f4ac0688a61cde8ac5c503c2813949

SHA1
f5de8ca5d1259ef7ffa447e7f2612aebdb5dc479

SHA256
1261e4a44371c9f82fd835902707e50837901782aa3fd0abe9309b5d63bb7e86

SHA512
06748a7425bfffc83536ee7421765aca4d9b9ce07a6600abeac232193b1968249d6bbe6c8c727ca9be0851d456d28b4f636879cb48a2453748b91e146f68d0f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe

Filesize
468KB

MD5
dea885e0d4c65908169f1ee801481833

SHA1
40995331db4cde6b0f6069ebf030d00d672be9a5

SHA256
7285520a862899fe0f74f4ac2a0259e87f4cf391c17b8ab0f0d6c3f3f4b2f9f6

SHA512
699dbcbc88cd00c2d5c1d7a4a630156118336d69b3f2f73906a8c3a9df0700586da33f34d9445b839139ab53a374c7b2223d7963e3937b32e0ab4f2da535356a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40718.exe

Filesize
468KB

MD5
8813a0a7fd55590d641cd5694e455195

SHA1
5454e378e490b0b8a1f4a70d64de7e2ff7d75234

SHA256
5b78bfc5eab6fc1b3207802b53fa79c29f892f5d28e3d3e51e7ba701ed340583

SHA512
51e9524d6266f1d1bf770c2068a4ece7ab26198bb8dab9088b633d36a0fcce7dfc94adc74a3b155ec60dd0194e7dfcfaf444a44fd102ae4cc2f542bf0bde43ec

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15082.exe

Filesize
468KB

MD5
b4002eace1a5205325790b20877d8405

SHA1
52606fe39cce3cbaf15eb6bc1db3f8559ad75409

SHA256
2001989210fa65ad0351e2dc80d21eb727b027cb6073407c739c3c0a8db85dc8

SHA512
04a93263402b2e7881462c7c75348148db502170f69ecb381b527abe9fc49b15a120dbcd95b6925b283572dd0f07697080070a02cc6cd519678089fe746651ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe

Filesize
468KB

MD5
3e189b13dfdb88c422b6c6cebef33c21

SHA1
2930ac9c5110996ff40fea6e2cdf2b19d5a7b628

SHA256
bececaf7926b09de9e098f5635d329b6cd34378e9394f086a68b79f1a0b4f567

SHA512
7697418d93ca5ca4fa5eeafcdeab0f109fe4ae05a755a5e19f864e323fbd657b007327fa7da5281706f941ba86267cf65fc97c95fa2383c432e222267ebd95ab

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe

Filesize
468KB

MD5
fedcc1691851b0ebdba20da05a9cc8ec

SHA1
fd1f59512d5114fd966f6047e6b76ef0ae592bef

SHA256
f28ccf4873398c5371e2c286ea2e9f9da4b42d74398cec2d962970e849d78762

SHA512
ed12479a05badb0c28b515c17ea63ee6fb95b25ba69c88e1cf7b9427fd4e2181e11d80ccd2067b87754f8f2b381235053ba9e4484c8d4eb7dd3d581128e16e2b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3662.exe

Filesize
468KB

MD5
08b94b74f017f010ece4e8d5c750341e

SHA1
c89b879e114bbdf83fe96c8841d5e56be9c7b267

SHA256
19beb8a4a90b63a73eb3276f77e6048e794f731aac1a1b59ef060e0d583cb63a

SHA512
15bcd1c626373e9b9365e2f999ff21e91ce4d2e36c85439161d2d5deb91118de72f771958b90f98965042f54cf37d2fe2670ff533ffe75e922cbd7336542586e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe

Filesize
468KB

MD5
a96ddb0fbab50f0dd719eabe3c8a1cdb

SHA1
cd16fe91d781220e27095aa2bafbf421a1fec4ac

SHA256
4a793069a1c4f7ff630d57ad43f1ad6730b013d2b16002144a22b234362d3f71

SHA512
a56e144b98b969127905359a676dd1befb5269bd891f8defecc32cea15771504671f3faa03cbe77798094ddc295d58a242d6afba06429ef6d37404a9b5262305

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57812.exe

Filesize
468KB

MD5
bd0de6ff516c98d95343a62c4b28b700

SHA1
e1dc9b30f4c3ec46fcf087a4fa0f450466519241

SHA256
92c8e85e6f8556b99c702435d142c9debcb97a779cbf02253e790d619dbef28a

SHA512
a29592e278ad67446ab11214faff86f1049beac1aad522560880d8810c196a881fe6a7c3d9c12845c1a6ffab162eeb8f7745acac0bc938c7e3fe165233acc850

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60584.exe

Filesize
468KB

MD5
5217760532e6512164ffec6a1a94bcd4

SHA1
4dcccb3055a4e052a5a2474d6a58bd00f5e16ca7

SHA256
64b6c7f9b4e5013910d69d0aae8d054a447be9a1f73ad8ebfac6d5f19ea8c347

SHA512
460e58ac90b929a895d42868d08e0ceb04823df524d88d4bbcbd2a3a66b8d040625ddbc3772195ed157c8a216e5da9a3ccd6d88804b9711ac20074bb97708d48

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe

Filesize
468KB

MD5
6b9a4dd1bb1d0daac7c57789f5c2c4bf

SHA1
ee0269b940d2051abc1bda44ef11da161c3507dd

SHA256
ae3b525e6230c7e234d6a4a0f03fe3b7eecf1b2363cec3494f138bef5f20d14d

SHA512
3c3d7bec82b9dae078b6a891f71ca4c92b5c08aabd7f43fcefe617ea99cda74e7ef1d2ff61fb6e0b5fd914e08b8f2b56c410fc3315e3493b9de8dc94aad4b062

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe

Filesize
468KB

MD5
255eafc065cafaee71d0a4dce24aade5

SHA1
70c884c7ad833c8c3769b55ff89e4cb8059a13e3

SHA256
c20c550f310d2a2490b9f6357743656e515392d8bee467667d52b4a8fd8df833

SHA512
c9a0f468df8b684b7e4e3e87ce2da059041e1d3507e095e74dd7c21d0bb0ae5c625b0bb24b6176d97214009097a9ff027a1b955b6639e653d3dd00c5f5d37343

Download Submit