741a604bafcffc2a998d2dc4510d46f4a0d10b7b03fc18e100cc8ccf011937f9

Analysis

max time kernel
118s
max time network
14s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

978bda8099482738f0a99bb6ce8c9b60N.exe
Size

468KB
MD5

978bda8099482738f0a99bb6ce8c9b60
SHA1

600ac68e7c480d10a75447597a3a30fc39f5ab13
SHA256

741a604bafcffc2a998d2dc4510d46f4a0d10b7b03fc18e100cc8ccf011937f9
SHA512

80d35e76f2b2ede2fe837c5b6b4f44c9991c3046eb920cc4027a06803d125218949b097340c5e8d46d0f3cb55e42870f84b97fcded9f70ac90ce82c02c93c8b9
SSDEEP

3072:OQoHog6KI05QtbYJHzcOcfr/GChzP0pPnLHeaVP0iXKLOXDgyOWq:OQIot8QtOH4OcfxYSZiXMsDgy

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2308	Unicorn-23937.exe
2356	Unicorn-26925.exe
2092	Unicorn-38623.exe
2804	Unicorn-51472.exe
3048	Unicorn-39774.exe
2744	Unicorn-36790.exe
2824	Unicorn-42920.exe
2652	Unicorn-29246.exe
1548	Unicorn-23691.exe
2816	Unicorn-13101.exe
1552	Unicorn-1596.exe
2668	Unicorn-21462.exe
1992	Unicorn-51861.exe
2640	Unicorn-1596.exe
2872	Unicorn-21462.exe
2876	Unicorn-51799.exe
2124	Unicorn-8114.exe
2160	Unicorn-43439.exe
3004	Unicorn-20781.exe
696	Unicorn-29407.exe
3060	Unicorn-20087.exe
2460	Unicorn-24917.exe
1280	Unicorn-35852.exe
1744	Unicorn-36615.exe
1648	Unicorn-54797.exe
1596	Unicorn-44591.exe
1256	Unicorn-62965.exe
1416	Unicorn-7320.exe
1368	Unicorn-27186.exe
1192	Unicorn-16064.exe
1576	Unicorn-52069.exe
1668	Unicorn-31326.exe
1660	Unicorn-51192.exe
2120	Unicorn-35541.exe
2148	Unicorn-15675.exe
2860	Unicorn-21818.exe
2184	Unicorn-18520.exe
2416	Unicorn-16797.exe
2784	Unicorn-5862.exe
2840	Unicorn-58592.exe
2976	Unicorn-63039.exe
2636	Unicorn-50808.exe
1728	Unicorn-6054.exe
1724	Unicorn-50616.exe
2060	Unicorn-54766.exe
336	Unicorn-3527.exe
2928	Unicorn-3527.exe
2028	Unicorn-40345.exe
2648	Unicorn-59946.exe
2896	Unicorn-60211.exe
756	Unicorn-59754.exe
1588	Unicorn-60019.exe
1444	Unicorn-60019.exe
2932	Unicorn-921.exe
2924	Unicorn-6521.exe
2472	Unicorn-26387.exe
2532	Unicorn-6329.exe
1496	Unicorn-26195.exe
3024	Unicorn-43107.exe
304	Unicorn-36977.exe
2960	Unicorn-44953.exe
1932	Unicorn-49638.exe
2100	Unicorn-29580.exe
1436	Unicorn-25326.exe

Loads dropped DLL 64 IoCs

pid	Process
2152	978bda8099482738f0a99bb6ce8c9b60N.exe
2152	978bda8099482738f0a99bb6ce8c9b60N.exe
2308	Unicorn-23937.exe
2308	Unicorn-23937.exe
2152	978bda8099482738f0a99bb6ce8c9b60N.exe
2152	978bda8099482738f0a99bb6ce8c9b60N.exe
2092	Unicorn-38623.exe
2308	Unicorn-23937.exe
2092	Unicorn-38623.exe
2308	Unicorn-23937.exe
2152	978bda8099482738f0a99bb6ce8c9b60N.exe
2152	978bda8099482738f0a99bb6ce8c9b60N.exe
2356	Unicorn-26925.exe
2356	Unicorn-26925.exe
3048	Unicorn-39774.exe
3048	Unicorn-39774.exe
2308	Unicorn-23937.exe
2308	Unicorn-23937.exe
2804	Unicorn-51472.exe
2804	Unicorn-51472.exe
2356	Unicorn-26925.exe
2092	Unicorn-38623.exe
2824	Unicorn-42920.exe
2356	Unicorn-26925.exe
2824	Unicorn-42920.exe
2092	Unicorn-38623.exe
2744	Unicorn-36790.exe
2744	Unicorn-36790.exe
2152	978bda8099482738f0a99bb6ce8c9b60N.exe
2152	978bda8099482738f0a99bb6ce8c9b60N.exe
2652	Unicorn-29246.exe
2652	Unicorn-29246.exe
3048	Unicorn-39774.exe
3048	Unicorn-39774.exe
1548	Unicorn-23691.exe
1548	Unicorn-23691.exe
2308	Unicorn-23937.exe
2308	Unicorn-23937.exe
2872	Unicorn-21462.exe
2872	Unicorn-21462.exe
2640	Unicorn-1596.exe
2640	Unicorn-1596.exe
2744	Unicorn-36790.exe
2152	978bda8099482738f0a99bb6ce8c9b60N.exe
2744	Unicorn-36790.exe
2152	978bda8099482738f0a99bb6ce8c9b60N.exe
1552	Unicorn-1596.exe
1552	Unicorn-1596.exe
2092	Unicorn-38623.exe
2092	Unicorn-38623.exe
2668	Unicorn-21462.exe
2356	Unicorn-26925.exe
2668	Unicorn-21462.exe
2356	Unicorn-26925.exe
2824	Unicorn-42920.exe
2824	Unicorn-42920.exe
2816	Unicorn-13101.exe
2816	Unicorn-13101.exe
2804	Unicorn-51472.exe
2804	Unicorn-51472.exe
2876	Unicorn-51799.exe
2876	Unicorn-51799.exe
2652	Unicorn-29246.exe
2160	Unicorn-43439.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1524	2840	WerFault.exe	70
3524	696	WerFault.exe	50
3672	2944	WerFault.exe	110
4504	768	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45187.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2152	978bda8099482738f0a99bb6ce8c9b60N.exe
2308	Unicorn-23937.exe
2092	Unicorn-38623.exe
2356	Unicorn-26925.exe
3048	Unicorn-39774.exe
2804	Unicorn-51472.exe
2744	Unicorn-36790.exe
2824	Unicorn-42920.exe
2652	Unicorn-29246.exe
1548	Unicorn-23691.exe
2872	Unicorn-21462.exe
2640	Unicorn-1596.exe
1552	Unicorn-1596.exe
2668	Unicorn-21462.exe
1992	Unicorn-51861.exe
2816	Unicorn-13101.exe
2876	Unicorn-51799.exe
2124	Unicorn-8114.exe
2160	Unicorn-43439.exe
3004	Unicorn-20781.exe
696	Unicorn-29407.exe
3060	Unicorn-20087.exe
1280	Unicorn-35852.exe
1744	Unicorn-36615.exe
2460	Unicorn-24917.exe
1648	Unicorn-54797.exe
1256	Unicorn-62965.exe
1596	Unicorn-44591.exe
1368	Unicorn-27186.exe
1192	Unicorn-16064.exe
1416	Unicorn-7320.exe
1576	Unicorn-52069.exe
1660	Unicorn-51192.exe
1668	Unicorn-31326.exe
2148	Unicorn-15675.exe
2120	Unicorn-35541.exe
2860	Unicorn-21818.exe
2184	Unicorn-18520.exe
2784	Unicorn-5862.exe
2416	Unicorn-16797.exe
2840	Unicorn-58592.exe
2636	Unicorn-50808.exe
2976	Unicorn-63039.exe
1728	Unicorn-6054.exe
1724	Unicorn-50616.exe
336	Unicorn-3527.exe
2060	Unicorn-54766.exe
2928	Unicorn-3527.exe
2028	Unicorn-40345.exe
2896	Unicorn-60211.exe
2648	Unicorn-59946.exe
756	Unicorn-59754.exe
1588	Unicorn-60019.exe
1444	Unicorn-60019.exe
2924	Unicorn-6521.exe
2932	Unicorn-921.exe
2472	Unicorn-26387.exe
2532	Unicorn-6329.exe
1496	Unicorn-26195.exe
304	Unicorn-36977.exe
3024	Unicorn-43107.exe
2960	Unicorn-44953.exe
1932	Unicorn-49638.exe
2100	Unicorn-29580.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2308	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	30
PID 2152 wrote to memory of 2308	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	30
PID 2152 wrote to memory of 2308	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	30
PID 2152 wrote to memory of 2308	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	30
PID 2308 wrote to memory of 2092	2308	Unicorn-23937.exe	32
PID 2308 wrote to memory of 2092	2308	Unicorn-23937.exe	32
PID 2308 wrote to memory of 2092	2308	Unicorn-23937.exe	32
PID 2308 wrote to memory of 2092	2308	Unicorn-23937.exe	32
PID 2152 wrote to memory of 2356	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	33
PID 2152 wrote to memory of 2356	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	33
PID 2152 wrote to memory of 2356	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	33
PID 2152 wrote to memory of 2356	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	33
PID 2092 wrote to memory of 2804	2092	Unicorn-38623.exe	34
PID 2092 wrote to memory of 2804	2092	Unicorn-38623.exe	34
PID 2092 wrote to memory of 2804	2092	Unicorn-38623.exe	34
PID 2092 wrote to memory of 2804	2092	Unicorn-38623.exe	34
PID 2308 wrote to memory of 3048	2308	Unicorn-23937.exe	35
PID 2308 wrote to memory of 3048	2308	Unicorn-23937.exe	35
PID 2308 wrote to memory of 3048	2308	Unicorn-23937.exe	35
PID 2308 wrote to memory of 3048	2308	Unicorn-23937.exe	35
PID 2152 wrote to memory of 2744	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	36
PID 2152 wrote to memory of 2744	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	36
PID 2152 wrote to memory of 2744	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	36
PID 2152 wrote to memory of 2744	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	36
PID 2356 wrote to memory of 2824	2356	Unicorn-26925.exe	37
PID 2356 wrote to memory of 2824	2356	Unicorn-26925.exe	37
PID 2356 wrote to memory of 2824	2356	Unicorn-26925.exe	37
PID 2356 wrote to memory of 2824	2356	Unicorn-26925.exe	37
PID 3048 wrote to memory of 2652	3048	Unicorn-39774.exe	38
PID 3048 wrote to memory of 2652	3048	Unicorn-39774.exe	38
PID 3048 wrote to memory of 2652	3048	Unicorn-39774.exe	38
PID 3048 wrote to memory of 2652	3048	Unicorn-39774.exe	38
PID 2308 wrote to memory of 1548	2308	Unicorn-23937.exe	39
PID 2308 wrote to memory of 1548	2308	Unicorn-23937.exe	39
PID 2308 wrote to memory of 1548	2308	Unicorn-23937.exe	39
PID 2308 wrote to memory of 1548	2308	Unicorn-23937.exe	39
PID 2804 wrote to memory of 2816	2804	Unicorn-51472.exe	40
PID 2804 wrote to memory of 2816	2804	Unicorn-51472.exe	40
PID 2804 wrote to memory of 2816	2804	Unicorn-51472.exe	40
PID 2804 wrote to memory of 2816	2804	Unicorn-51472.exe	40
PID 2356 wrote to memory of 1552	2356	Unicorn-26925.exe	41
PID 2356 wrote to memory of 1552	2356	Unicorn-26925.exe	41
PID 2356 wrote to memory of 1552	2356	Unicorn-26925.exe	41
PID 2356 wrote to memory of 1552	2356	Unicorn-26925.exe	41
PID 2824 wrote to memory of 2668	2824	Unicorn-42920.exe	43
PID 2824 wrote to memory of 2668	2824	Unicorn-42920.exe	43
PID 2824 wrote to memory of 2668	2824	Unicorn-42920.exe	43
PID 2824 wrote to memory of 2668	2824	Unicorn-42920.exe	43
PID 2092 wrote to memory of 2640	2092	Unicorn-38623.exe	42
PID 2092 wrote to memory of 2640	2092	Unicorn-38623.exe	42
PID 2092 wrote to memory of 2640	2092	Unicorn-38623.exe	42
PID 2092 wrote to memory of 2640	2092	Unicorn-38623.exe	42
PID 2744 wrote to memory of 2872	2744	Unicorn-36790.exe	44
PID 2744 wrote to memory of 2872	2744	Unicorn-36790.exe	44
PID 2744 wrote to memory of 2872	2744	Unicorn-36790.exe	44
PID 2744 wrote to memory of 2872	2744	Unicorn-36790.exe	44
PID 2152 wrote to memory of 1992	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	45
PID 2152 wrote to memory of 1992	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	45
PID 2152 wrote to memory of 1992	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	45
PID 2152 wrote to memory of 1992	2152	978bda8099482738f0a99bb6ce8c9b60N.exe	45
PID 2652 wrote to memory of 2876	2652	Unicorn-29246.exe	46
PID 2652 wrote to memory of 2876	2652	Unicorn-29246.exe	46
PID 2652 wrote to memory of 2876	2652	Unicorn-29246.exe	46
PID 2652 wrote to memory of 2876	2652	Unicorn-29246.exe	46

C:\Users\Admin\AppData\Local\Temp\978bda8099482738f0a99bb6ce8c9b60N.exe
"C:\Users\Admin\AppData\Local\Temp\978bda8099482738f0a99bb6ce8c9b60N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51472.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27186.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        8⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        9⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31667.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        9⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        9⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe
        8⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        8⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
        8⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55019.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-879.exe
        8⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
        8⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
        7⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6969.exe
        8⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        8⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        7⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40345.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34620.exe
        7⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        8⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        8⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        8⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        8⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        7⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
        7⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3217.exe
        6⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        8⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        7⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40268.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        8⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        8⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        7⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        7⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        6⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53956.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        7⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        7⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25492.exe
        6⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
        6⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        6⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6882.exe
        5⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19310.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18079.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        5⤵
        
        PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50808.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50105.exe
        7⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        8⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
        8⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
        8⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        7⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
        6⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        7⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        6⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        7⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        6⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-220.exe
        7⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        7⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28459.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
        5⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        7⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        6⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55149.exe
        5⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54276.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
        5⤵
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60211.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        6⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        6⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58434.exe
        5⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        6⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        5⤵
        
        PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59754.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62576.exe
      4⤵
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35145.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39774.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29246.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51799.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        8⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        9⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        9⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        9⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        8⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        8⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17562.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        7⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29580.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        7⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        8⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28439.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        7⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24535.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
        6⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        7⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34614.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        6⤵
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15814.exe
        6⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exe
        7⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        7⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
        6⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        7⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        6⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        5⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61475.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32514.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        6⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        7⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        6⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62528.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        6⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        7⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40939.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        6⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        5⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        5⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51258.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        6⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
        5⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        6⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
      4⤵
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        5⤵
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62576.exe
      4⤵
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36520.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
        5⤵
        
        PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35145.exe
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
      4⤵
      PID:6364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51192.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
        6⤵
        Executes dropped EXE
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        7⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        7⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        6⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30354.exe
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        6⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54469.exe
        5⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        6⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        6⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        6⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        5⤵
        
        PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
        5⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65482.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        6⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24163.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28439.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
      4⤵
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14490.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18520.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58465.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7588.exe
        6⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        6⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        7⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48831.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28439.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        5⤵
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        6⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        6⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26487.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
        5⤵
        
        PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48112.exe
      4⤵
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        6⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        5⤵
        
        PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
      4⤵
      PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
      4⤵
      PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
      4⤵
      PID:6624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16797.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7889.exe
      4⤵
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35005.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
      4⤵
      PID:7720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7587.exe
    3⤵
    PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
      4⤵
      PID:6876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60377.exe
    3⤵
    PID:3148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13614.exe
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
    3⤵
    PID:7248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26925.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26925.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42920.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21462.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26387.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        7⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51481.exe
        8⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23679.exe
        8⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        8⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        8⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34196.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        5⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43107.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        6⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        5⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23679.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        6⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
        5⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        6⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        6⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13442.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        5⤵
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        5⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-137.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39216.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        5⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6847.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        6⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
      4⤵
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
      4⤵
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12718.exe
        5⤵
        
        PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23732.exe
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
      4⤵
      PID:7056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36615.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47777.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
        5⤵
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6521.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5969.exe
        5⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        6⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        5⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10757.exe
        6⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exe
      4⤵
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34614.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
      4⤵
      PID:7112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10800.exe
      4⤵
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57781.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
        5⤵
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        5⤵
        
        PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
      4⤵
      PID:6320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
      4⤵
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
      4⤵
      PID:7664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40016.exe
    3⤵
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
    3⤵
    PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
    3⤵
    PID:7096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36790.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36790.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21462.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29407.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        6⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 236
        7⤵
        Program crash
        
        PID:3672
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 236
        6⤵
        Program crash
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        5⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44304.exe
        6⤵
        
        PID:3932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 216
        6⤵
        Program crash
        
        PID:4504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 240
        5⤵
        Program crash
        
        PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        5⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        6⤵
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
      4⤵
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
        5⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exe
        6⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44563.exe
      4⤵
      PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        5⤵
        
        PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
      4⤵
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20303.exe
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48890.exe
      4⤵
      PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24917.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
        5⤵
        
        PID:484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        6⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
        5⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43155.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        6⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
      4⤵
      PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36977.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
      4⤵
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        5⤵
        
        PID:564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33706.exe
      4⤵
      PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
      4⤵
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
    3⤵
    PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
      4⤵
      PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
    3⤵
    PID:6776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
      4⤵
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        5⤵
        
        PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
      4⤵
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63448.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15792.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
      4⤵
      PID:7072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3217.exe
    3⤵
    PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24066.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
      4⤵
      PID:6736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
    3⤵
    PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34614.exe
    3⤵
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
    3⤵
    PID:6836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35852.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35852.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6955.exe
      4⤵
      PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6847.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        5⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        5⤵
        
        PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
      4⤵
      PID:6344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27629.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
      4⤵
      PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
    3⤵
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30354.exe
    3⤵
    PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
    3⤵
    PID:6444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-921.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-921.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5403.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
      4⤵
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
    3⤵
    PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
      4⤵
      PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
      4⤵
      PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45387.exe
    3⤵
    PID:6768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
  2⤵
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28.exe
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
    3⤵
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
    3⤵
    PID:7036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
  2⤵
  PID:4052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8279.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8279.exe
  2⤵
  PID:4996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exe
  2⤵
  PID:6892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe

Filesize
468KB

MD5
a633c8d3c91164d6a0e98d534fbf8697

SHA1
aaf617f16ba233be022ce365aeb7e4d6c4700f15

SHA256
3115c5fb4de7b42b17c716b1bb0f1e40079ca66ecf889106f1508067a33b0728

SHA512
a1fb5323dce61bd0671226b57c92b90133f7cc75d6b0f561acfd73f5c471b0b713536b4e1f3639c290ca123388ed6742b5fd01c822bcb3fa8efd86ed0feb3bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26925.exe

Filesize
468KB

MD5
8312b8713a0496cc4795943761f7e4ff

SHA1
501a2fda43d899ac591123deb6465dc64d3f676c

SHA256
5d53a2a6356c57c6699ca5dd68a48b966162effe5bcbefef6f1a3f7393f97ecf

SHA512
3599999f6e5bd4f6ea55e0bb14b136f6b95eb7b42cd8e6121534b2cfe856b8391fb4c0e533c31de74e1081b55cd3c620b0c81a1c2fe9876b0f9653367e252cd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29246.exe

Filesize
468KB

MD5
6affd91520797e1e86f02c118cba400e

SHA1
7b629ba1d55182d2a099832192f3c7349edb2da8

SHA256
e1a38da96430366ebbca4ad5e125b33cdf1f51b497121c150847f765bf0d4604

SHA512
5f914052dadd1f657608f83f01ca319c104910d3472de1eb35dbf7dd6041ec7a37673c9b0e9dff7c0ed5cbc1952090477a087c3781a78e200049ee52787cc0db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42920.exe

Filesize
468KB

MD5
bb2ac83c270e0c80fd851124d028a9b8

SHA1
90de2862f4724a4bb8417cf21c330b6f850a990c

SHA256
1bc042518fbffdb8f5e19996bf0e52ef55ef4dfe3fcd62ad564f4d2c2f0aaebf

SHA512
fb557fc258ac3db9859528ade4f765624a6aaa7bbe9140b462b209e6ee95ba59b2e1aee8bd5fdc9aa2fdd6eba2437e5978cffdd58b89ee0fca7125bec696c587

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43155.exe

Filesize
468KB

MD5
e64d6126b34fc45ec25b6dc93ccc0d3b

SHA1
1f3f9539a0ea9d7c3cc9b18436e5d7b93bbca714

SHA256
df99660904b9538aea403ab5cc54696d35c13512d8d139e334d5a8ddb3e4428a

SHA512
ffe8e090cb37b57a2482d0523ffb15d3957a13927a1afaaeb9f9d5c6dd9e0b35cf37467f281ebbe164b24017d74335f0879e1f43b90eb942b9d16777da4807e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44563.exe

Filesize
468KB

MD5
1f51857e74cc302dd0a71e0a53067513

SHA1
e303ae73e3163a0f4935b040543cae1374f771e3

SHA256
4a4bf2649d85464b2285182b9a8e06c823123c6138fba0cc6ae213b9de6b2fed

SHA512
a85aff07f564de99b949c26768dc9ac0f52999b3f651ed6bb0edc27cb1a16e0f293afc9ee8fc985e7a925b8618359d3681487f6c318d53639d78a4bbf8d34195

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe

Filesize
468KB

MD5
a5165cd2fad8bca2d3816d20ed8a12f0

SHA1
dc38981406334e9f9c95fa10c4e1e5c6abfb9f3f

SHA256
a9a13599beb2b2604d315383ec5f2bb35eb66c494fe20dbb0103ad47dfa14c48

SHA512
1d05d936d60e5a071bf9f86bbb1e7f2f07bb7d1c17de5b3af13aeae7cd029f97a63eb393bd1179016bfe23f51b135d3a2e545f447b756197461201e89bff8f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe

Filesize
468KB

MD5
db145ae612a2e40db15b7cd291116708

SHA1
bf14b220a0167c31532d2b2b7884053a2b973ee1

SHA256
7fcacc189d1221bcd45e80545d863a63584b451927bda5c4dc12c9a33ba3622c

SHA512
2ac05180ced1a1595c7c77f5ae6d12f872035ef8745066a053ede59af07d8d0d4d2aafe612ddf94a08698c54c3afbe04441ff403a19d2cfb6a8de9b59d004ff0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe

Filesize
468KB

MD5
f8fe17d9477424be2df6f1755ae10143

SHA1
b19757ad85ab4149c0bb579adea480a1f5671f1e

SHA256
97e9a7f873954a75eaabb2ca5c767221644f6f32cf087f957414ca3deca0b168

SHA512
f4f7b43a00ceb9133b4113b7b2efc2a449f2af0f009d6ec663a359adaa2427f94dd802a866bd28acc5b7c8f1ad4f78f47edcdf83195df7fbd0d28aae2e77cffa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21462.exe

Filesize
468KB

MD5
b9b3978bb4676ffa1a97679b767fdafa

SHA1
5c36b51993268eed11f0a638c715281a9436c31c

SHA256
c0f5a12fadbd0b9a67152977a2649ea6882fe173369cb54cc874aab092ce2421

SHA512
9967b6157d01a5c8f96e7e6d8d7b0e5ee04d47478941009a7d734ac050109719ffd8357b3dc32d1d1c9ef81c0d016c5d87eb03f33d457fb730bc082d47a8adf9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe

Filesize
468KB

MD5
917602e40123984275039e8ec5defde9

SHA1
df693190d616525287b9f0db703c0a1f1ad8b111

SHA256
615481a88124c27f56477d4a419ba5f79af4b3cbbca11b2341bf1706d8fc6fd0

SHA512
987f7406371a30f6149e36d4ecfd0452334d3a6547fa322fb781da3c238aa5bc6ae723fee1f40bbf74fa384f6c76ec83d1b608f181abe9ff71e336a81e54cd72

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe

Filesize
468KB

MD5
236532aa2a00d795d27519648f9a9d36

SHA1
c16d095a8ec1e92bfdfec7ad685274538ea8911a

SHA256
22e23b666cd72d31e23d35e110b6b621fb553aafd767acfd411fc7d60e633ee9

SHA512
39047f7d359697666ae457187a016c52dee1dead30b871f0e201e05e13f91fd45e3729c51781239f03d34dead62dc147247e2ecbff85bfa93d65e5479ece4ee6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36790.exe

Filesize
468KB

MD5
21325101a57c27515235612100e39f87

SHA1
d334801d2fe99d6079d9ed1997fe39611d9b6d74

SHA256
d04cc5803deb28dbd64d6b5d466472b1d788bb5f49be67ff7147ebfd0615363b

SHA512
2fdccb15f159ce00ce9604a192904ae463e6c71b20dfac29ea9b08d2905efdac457a001c67e10b59b8e71b07d6848419b45f64ffe446b285ad49402742bdf184

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe

Filesize
468KB

MD5
99a87ade9707fc0fe97cc3075f9170b0

SHA1
4486b9be6edb5d0c191dd0b0f9fb950e80d0d982

SHA256
d424376e2daada2961ee799892176dbc03db0d187cfd9cca4364752c293d74b8

SHA512
32e5952e3ca72c7be34f24b64cfea0834f160e4b60e796cca906c836ba666c018fdd88da7be0239ac34564684a8e638a335a0073fe29eadf79bee37fb2a5b03e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39774.exe

Filesize
468KB

MD5
631ffb9e753c249a1f09fecc1ddc8389

SHA1
8e2f9af4b0885c1933fd4a4c7dd925c4b9dbead2

SHA256
d2fe0671d417a21fcd27a94d5aad43ba00aa40bdbbd687622171985497d016eb

SHA512
6cf8ef4e73d4f1f7d8b9941381a1ab16b117a7eeb630db8e282a347495a6aa276aaeb73458b3d42a34bca9a116226b5bb065baf9c39945e70c1135c1e131d9db

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe

Filesize
468KB

MD5
7d9223f1bd7c858bf0d47ed3fc66c004

SHA1
0627d1af1d091030fdcb2a3e338555e95f193973

SHA256
89d5f1ecfb8ff83360c5cca1bc2f2cb62de0db14c8a2f6832cf581d0c3c2cb02

SHA512
52ae72243ff71626eb73f6e80c03111af386f259623f556c45bb27950ef12ae7fb418182e36291a6a73a6154fdf0f7317d8160d234348450612b30fa7a6b3ade

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51472.exe

Filesize
468KB

MD5
454ff55a5f945aed6a2bf6fddc990838

SHA1
37f3e376f92688ac10aede9163ed4af824254d74

SHA256
7d8bf825b4d4929f80b8bd9f692bf7254e54750203087970c0ed404217fe8f7e

SHA512
4606433f5e3265ec75291cfe9dc5d0967d344dcc7fe2224ff2dbcde0932645ba6023d2cd23694e7d7d7c1082fa7d2576eaf006c1578360d53a51c2fefa5c2d5b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51799.exe

Filesize
468KB

MD5
9b5eb0d7421281e595ab7beec3d50902

SHA1
b508e8b45b89ee7bc939e0915d3ec14e00ba17ba

SHA256
d801e1b61b4dea26ed386a730510e39bfecf2898c4c2cba87de5ae9dfd1d62ca

SHA512
00270f021ed5c52781cd402b4aaa0062bf36ca3321b0bbe6cfcd8c65ace8cff4c7c1a80d8ef56655ffd0796cc4a6b2fcd2e57ed42953b528c5156d9a7bcbc663

Download Submit