dba30ba6e06ecd7c301b1a3106337be2297961bae1fc83c6b52e797ee499cc62

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3330dff5ac3fbffbe86225b0cc838100N.exe
Size

468KB
MD5

3330dff5ac3fbffbe86225b0cc838100
SHA1

fc9b7594e7031a399e1cae69b0ff86f299f4b3f6
SHA256

dba30ba6e06ecd7c301b1a3106337be2297961bae1fc83c6b52e797ee499cc62
SHA512

796fe0bf954be06befb4a74fbfc794581ba93b84073900ed1e0a8b585f58ddbb4dab7c55e9292acea6d52c2651384147852853b47c3b09213a49e85aba344b45
SSDEEP

3072:1U0KodIKq85UDbYJH5cOAf8/XCuzq0pBnLHewmZP/iV+ifRs6zlh:1U5oiUUDOHSOAfHYUF/icMRs6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2700	Unicorn-27699.exe
2864	Unicorn-14735.exe
2720	Unicorn-47387.exe
3064	Unicorn-59406.exe
2604	Unicorn-36940.exe
1744	Unicorn-43070.exe
3044	Unicorn-23204.exe
2768	Unicorn-46443.exe
2268	Unicorn-43105.exe
1320	Unicorn-39235.exe
1464	Unicorn-22899.exe
1724	Unicorn-22899.exe
2328	Unicorn-14465.exe
2844	Unicorn-16768.exe
916	Unicorn-3225.exe
1800	Unicorn-33480.exe
1784	Unicorn-58731.exe
2432	Unicorn-46692.exe
1088	Unicorn-16057.exe
652	Unicorn-26464.exe
2532	Unicorn-22358.exe
988	Unicorn-5467.exe
2984	Unicorn-12658.exe
1228	Unicorn-58752.exe
1792	Unicorn-58752.exe
880	Unicorn-42723.exe
1680	Unicorn-43220.exe
1688	Unicorn-43485.exe
2260	Unicorn-31233.exe
1900	Unicorn-7283.exe
1928	Unicorn-32711.exe
3012	Unicorn-37777.exe
1440	Unicorn-10812.exe
3068	Unicorn-14341.exe
1552	Unicorn-58389.exe
1656	Unicorn-58389.exe
2732	Unicorn-52259.exe
2868	Unicorn-15088.exe
2772	Unicorn-21668.exe
2312	Unicorn-13765.exe
2636	Unicorn-39016.exe
2668	Unicorn-46630.exe
3052	Unicorn-28247.exe
1740	Unicorn-18042.exe
804	Unicorn-54990.exe
2628	Unicorn-3220.exe
2688	Unicorn-10568.exe
2348	Unicorn-23278.exe
2196	Unicorn-23278.exe
2128	Unicorn-23278.exe
1208	Unicorn-11025.exe
1640	Unicorn-37760.exe
2160	Unicorn-25507.exe
2652	Unicorn-10256.exe
536	Unicorn-59650.exe
332	Unicorn-39784.exe
2324	Unicorn-60397.exe
2204	Unicorn-14725.exe
2484	Unicorn-5795.exe
2488	Unicorn-59842.exe
1000	Unicorn-23640.exe
1300	Unicorn-43506.exe
112	Unicorn-49105.exe
2104	Unicorn-1186.exe

Loads dropped DLL 64 IoCs

pid	Process
2272	3330dff5ac3fbffbe86225b0cc838100N.exe
2272	3330dff5ac3fbffbe86225b0cc838100N.exe
2700	Unicorn-27699.exe
2272	3330dff5ac3fbffbe86225b0cc838100N.exe
2700	Unicorn-27699.exe
2272	3330dff5ac3fbffbe86225b0cc838100N.exe
2864	Unicorn-14735.exe
2864	Unicorn-14735.exe
2272	3330dff5ac3fbffbe86225b0cc838100N.exe
2272	3330dff5ac3fbffbe86225b0cc838100N.exe
2720	Unicorn-47387.exe
2700	Unicorn-27699.exe
2700	Unicorn-27699.exe
2720	Unicorn-47387.exe
3064	Unicorn-59406.exe
3064	Unicorn-59406.exe
2864	Unicorn-14735.exe
2864	Unicorn-14735.exe
3044	Unicorn-23204.exe
3044	Unicorn-23204.exe
1744	Unicorn-43070.exe
2604	Unicorn-36940.exe
1744	Unicorn-43070.exe
2272	3330dff5ac3fbffbe86225b0cc838100N.exe
2272	3330dff5ac3fbffbe86225b0cc838100N.exe
2604	Unicorn-36940.exe
2700	Unicorn-27699.exe
2700	Unicorn-27699.exe
2720	Unicorn-47387.exe
2720	Unicorn-47387.exe
2768	Unicorn-46443.exe
2768	Unicorn-46443.exe
3064	Unicorn-59406.exe
3064	Unicorn-59406.exe
2268	Unicorn-43105.exe
2268	Unicorn-43105.exe
2864	Unicorn-14735.exe
2864	Unicorn-14735.exe
1320	Unicorn-39235.exe
1320	Unicorn-39235.exe
3044	Unicorn-23204.exe
3044	Unicorn-23204.exe
916	Unicorn-3225.exe
916	Unicorn-3225.exe
2720	Unicorn-47387.exe
2720	Unicorn-47387.exe
2328	Unicorn-14465.exe
2844	Unicorn-16768.exe
2328	Unicorn-14465.exe
2844	Unicorn-16768.exe
2272	3330dff5ac3fbffbe86225b0cc838100N.exe
2272	3330dff5ac3fbffbe86225b0cc838100N.exe
2700	Unicorn-27699.exe
1724	Unicorn-22899.exe
2700	Unicorn-27699.exe
1724	Unicorn-22899.exe
1464	Unicorn-22899.exe
1464	Unicorn-22899.exe
2604	Unicorn-36940.exe
2604	Unicorn-36940.exe
1744	Unicorn-43070.exe
1744	Unicorn-43070.exe
1800	Unicorn-33480.exe
1800	Unicorn-33480.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5700	4992	WerFault.exe	346

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52259.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2272	3330dff5ac3fbffbe86225b0cc838100N.exe
2700	Unicorn-27699.exe
2864	Unicorn-14735.exe
2720	Unicorn-47387.exe
3064	Unicorn-59406.exe
2604	Unicorn-36940.exe
3044	Unicorn-23204.exe
1744	Unicorn-43070.exe
2768	Unicorn-46443.exe
2268	Unicorn-43105.exe
1320	Unicorn-39235.exe
916	Unicorn-3225.exe
2328	Unicorn-14465.exe
2844	Unicorn-16768.exe
1724	Unicorn-22899.exe
1464	Unicorn-22899.exe
1800	Unicorn-33480.exe
1784	Unicorn-58731.exe
2432	Unicorn-46692.exe
1088	Unicorn-16057.exe
652	Unicorn-26464.exe
2532	Unicorn-22358.exe
988	Unicorn-5467.exe
2984	Unicorn-12658.exe
1228	Unicorn-58752.exe
1792	Unicorn-58752.exe
880	Unicorn-42723.exe
1900	Unicorn-7283.exe
1688	Unicorn-43485.exe
1680	Unicorn-43220.exe
2260	Unicorn-31233.exe
1928	Unicorn-32711.exe
3012	Unicorn-37777.exe
1440	Unicorn-10812.exe
3068	Unicorn-14341.exe
1552	Unicorn-58389.exe
1656	Unicorn-58389.exe
2732	Unicorn-52259.exe
2868	Unicorn-15088.exe
2772	Unicorn-21668.exe
2312	Unicorn-13765.exe
2636	Unicorn-39016.exe
2668	Unicorn-46630.exe
3052	Unicorn-28247.exe
1740	Unicorn-18042.exe
804	Unicorn-54990.exe
2628	Unicorn-3220.exe
2688	Unicorn-10568.exe
2348	Unicorn-23278.exe
2128	Unicorn-23278.exe
2196	Unicorn-23278.exe
1208	Unicorn-11025.exe
1640	Unicorn-37760.exe
2160	Unicorn-25507.exe
2652	Unicorn-10256.exe
536	Unicorn-59650.exe
332	Unicorn-39784.exe
2484	Unicorn-5795.exe
2324	Unicorn-60397.exe
2204	Unicorn-14725.exe
2488	Unicorn-59842.exe
1000	Unicorn-23640.exe
1300	Unicorn-43506.exe
112	Unicorn-49105.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2700	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	30
PID 2272 wrote to memory of 2700	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	30
PID 2272 wrote to memory of 2700	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	30
PID 2272 wrote to memory of 2700	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	30
PID 2700 wrote to memory of 2864	2700	Unicorn-27699.exe	31
PID 2700 wrote to memory of 2864	2700	Unicorn-27699.exe	31
PID 2700 wrote to memory of 2864	2700	Unicorn-27699.exe	31
PID 2700 wrote to memory of 2864	2700	Unicorn-27699.exe	31
PID 2272 wrote to memory of 2720	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	32
PID 2272 wrote to memory of 2720	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	32
PID 2272 wrote to memory of 2720	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	32
PID 2272 wrote to memory of 2720	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	32
PID 2864 wrote to memory of 3064	2864	Unicorn-14735.exe	33
PID 2864 wrote to memory of 3064	2864	Unicorn-14735.exe	33
PID 2864 wrote to memory of 3064	2864	Unicorn-14735.exe	33
PID 2864 wrote to memory of 3064	2864	Unicorn-14735.exe	33
PID 2272 wrote to memory of 2604	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	34
PID 2272 wrote to memory of 2604	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	34
PID 2272 wrote to memory of 2604	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	34
PID 2272 wrote to memory of 2604	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	34
PID 2700 wrote to memory of 3044	2700	Unicorn-27699.exe	36
PID 2700 wrote to memory of 3044	2700	Unicorn-27699.exe	36
PID 2700 wrote to memory of 3044	2700	Unicorn-27699.exe	36
PID 2700 wrote to memory of 3044	2700	Unicorn-27699.exe	36
PID 2720 wrote to memory of 1744	2720	Unicorn-47387.exe	35
PID 2720 wrote to memory of 1744	2720	Unicorn-47387.exe	35
PID 2720 wrote to memory of 1744	2720	Unicorn-47387.exe	35
PID 2720 wrote to memory of 1744	2720	Unicorn-47387.exe	35
PID 3064 wrote to memory of 2768	3064	Unicorn-59406.exe	37
PID 3064 wrote to memory of 2768	3064	Unicorn-59406.exe	37
PID 3064 wrote to memory of 2768	3064	Unicorn-59406.exe	37
PID 3064 wrote to memory of 2768	3064	Unicorn-59406.exe	37
PID 2864 wrote to memory of 2268	2864	Unicorn-14735.exe	38
PID 2864 wrote to memory of 2268	2864	Unicorn-14735.exe	38
PID 2864 wrote to memory of 2268	2864	Unicorn-14735.exe	38
PID 2864 wrote to memory of 2268	2864	Unicorn-14735.exe	38
PID 3044 wrote to memory of 1320	3044	Unicorn-23204.exe	39
PID 3044 wrote to memory of 1320	3044	Unicorn-23204.exe	39
PID 3044 wrote to memory of 1320	3044	Unicorn-23204.exe	39
PID 3044 wrote to memory of 1320	3044	Unicorn-23204.exe	39
PID 1744 wrote to memory of 1464	1744	Unicorn-43070.exe	40
PID 1744 wrote to memory of 1464	1744	Unicorn-43070.exe	40
PID 1744 wrote to memory of 1464	1744	Unicorn-43070.exe	40
PID 1744 wrote to memory of 1464	1744	Unicorn-43070.exe	40
PID 2272 wrote to memory of 2328	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	42
PID 2272 wrote to memory of 2328	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	42
PID 2272 wrote to memory of 2328	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	42
PID 2272 wrote to memory of 2328	2272	3330dff5ac3fbffbe86225b0cc838100N.exe	42
PID 2604 wrote to memory of 1724	2604	Unicorn-36940.exe	41
PID 2604 wrote to memory of 1724	2604	Unicorn-36940.exe	41
PID 2604 wrote to memory of 1724	2604	Unicorn-36940.exe	41
PID 2604 wrote to memory of 1724	2604	Unicorn-36940.exe	41
PID 2700 wrote to memory of 2844	2700	Unicorn-27699.exe	43
PID 2700 wrote to memory of 2844	2700	Unicorn-27699.exe	43
PID 2700 wrote to memory of 2844	2700	Unicorn-27699.exe	43
PID 2700 wrote to memory of 2844	2700	Unicorn-27699.exe	43
PID 2720 wrote to memory of 916	2720	Unicorn-47387.exe	44
PID 2720 wrote to memory of 916	2720	Unicorn-47387.exe	44
PID 2720 wrote to memory of 916	2720	Unicorn-47387.exe	44
PID 2720 wrote to memory of 916	2720	Unicorn-47387.exe	44
PID 2768 wrote to memory of 1800	2768	Unicorn-46443.exe	45
PID 2768 wrote to memory of 1800	2768	Unicorn-46443.exe	45
PID 2768 wrote to memory of 1800	2768	Unicorn-46443.exe	45
PID 2768 wrote to memory of 1800	2768	Unicorn-46443.exe	45

C:\Users\Admin\AppData\Local\Temp\3330dff5ac3fbffbe86225b0cc838100N.exe
"C:\Users\Admin\AppData\Local\Temp\3330dff5ac3fbffbe86225b0cc838100N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14735.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33480.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        8⤵
        Executes dropped EXE
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        9⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41308.exe
        9⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        9⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        8⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        8⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50205.exe
        8⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        8⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        7⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        8⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        9⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
        9⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        9⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        9⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        8⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10812.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62831.exe
        7⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        8⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        8⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1565.exe
        7⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17558.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        7⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        6⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62351.exe
        8⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        7⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        7⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12457.exe
        6⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58027.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
        6⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53589.exe
        6⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        7⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exe
        8⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55836.exe
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        8⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61403.exe
        7⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6157.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        7⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38305.exe
        6⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        7⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
        7⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10121.exe
        6⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17703.exe
        6⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        6⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52259.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        6⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        7⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36318.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        6⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        5⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        6⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21875.exe
        6⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exe
        5⤵
        
        PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43105.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58389.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        7⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17191.exe
        8⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        9⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exe
        9⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
        9⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        9⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        8⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        8⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        8⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6592.exe
        7⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50064.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9323.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        7⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56722.exe
        6⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        7⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        7⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48162.exe
        6⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29810.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18041.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38550.exe
        6⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        6⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        7⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36707.exe
        7⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32431.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        6⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        6⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        5⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27731.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7713.exe
        6⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48482.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8073.exe
        5⤵
        
        PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58389.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
        6⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        7⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
        5⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        6⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27958.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
        5⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        6⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        6⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42592.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
        5⤵
        
        PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64689.exe
        5⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
        6⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        6⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        6⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        5⤵
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12030.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52613.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23104.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
      4⤵
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29625.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        5⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        5⤵
        
        PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63199.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39173.exe
      4⤵
      PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
      4⤵
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
      4⤵
      PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39235.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26464.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18099.exe
        7⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60081.exe
        8⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        8⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
        8⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        8⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        8⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        7⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30453.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
        7⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe
        6⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        7⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1155.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13275.exe
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        6⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39016.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        7⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6443.exe
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27766.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        6⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
        6⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        6⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20520.exe
        5⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8083.exe
        6⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        5⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56488.exe
        6⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        6⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56901.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
        5⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        6⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
        7⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41308.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        6⤵
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45643.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34662.exe
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10869.exe
        5⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43531.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49097.exe
        6⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 188
        7⤵
        Program crash
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9214.exe
        6⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10121.exe
        5⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
        6⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52970.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3784.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        5⤵
        
        PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28247.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        5⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38677.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        5⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        6⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56749.exe
        5⤵
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
      4⤵
      PID:340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4549.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7713.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54090.exe
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
      4⤵
      PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
      4⤵
      PID:7276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16768.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40569.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10491.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        7⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50745.exe
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21841.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35164.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
        6⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        6⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61154.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18226.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exe
        5⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
      4⤵
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        5⤵
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60081.exe
      4⤵
      PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
      4⤵
      PID:7296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43220.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59650.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
        5⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3226.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
        6⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        5⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23811.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        5⤵
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43479.exe
      4⤵
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8083.exe
        5⤵
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        5⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        5⤵
        
        PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22181.exe
      4⤵
      PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
      4⤵
      PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
      4⤵
      PID:8128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
      4⤵
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
        5⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        5⤵
        
        PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16474.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
      4⤵
      PID:6960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
    3⤵
    PID:2584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52636.exe
    3⤵
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32499.exe
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7559.exe
    3⤵
    PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
    3⤵
    PID:7472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47387.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47387.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22899.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11025.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        7⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        8⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        8⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        7⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61278.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8238.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62878.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        8⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25210.exe
        8⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
        8⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
        7⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27766.exe
        7⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57147.exe
        6⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52613.exe
        6⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56545.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17539.exe
        6⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        6⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        6⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5269.exe
        5⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10343.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        5⤵
        
        PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32711.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exe
        6⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        7⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3110.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40019.exe
        7⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51150.exe
        6⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6966.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        6⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        5⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exe
        6⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22395.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
        5⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19084.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18087.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        5⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        5⤵
        
        PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        5⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29443.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9503.exe
        6⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        6⤵
        
        PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3458.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17558.exe
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        5⤵
        
        PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
      4⤵
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        5⤵
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        5⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36707.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62827.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3225.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        6⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34974.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        7⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29766.exe
        6⤵
        
        PID:856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27928.exe
        6⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        6⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        6⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        5⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        5⤵
        
        PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60278.exe
        5⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39826.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19150.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54340.exe
      4⤵
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59619.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39987.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18838.exe
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12658.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43909.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20358.exe
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        6⤵
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36510.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29487.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54502.exe
      4⤵
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9390.exe
      4⤵
      PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
      4⤵
      PID:7660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10568.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
      4⤵
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6443.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        5⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        5⤵
        
        PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
      4⤵
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27869.exe
        5⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
        5⤵
        
        PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10802.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
      4⤵
      PID:7064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
    3⤵
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
      4⤵
      PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17181.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58075.exe
        5⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        5⤵
        
        PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
      4⤵
      PID:6600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exe
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6500.exe
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
    3⤵
    PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38249.exe
    3⤵
    PID:7180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36940.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36940.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22899.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37959.exe
        6⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        6⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
        5⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
        5⤵
        
        PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60397.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9567.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
        6⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        6⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        6⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30453.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58768.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        5⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exe
      4⤵
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        5⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
        5⤵
        
        PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17570.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
      4⤵
      PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
      4⤵
      PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
      4⤵
      PID:7568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5654.exe
        5⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        6⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25912.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56991.exe
        7⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30453.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27769.exe
        5⤵
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48394.exe
      4⤵
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
        5⤵
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46167.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48189.exe
      4⤵
      PID:6456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25507.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
      4⤵
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62351.exe
        5⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        5⤵
        
        PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
      4⤵
      PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
      4⤵
      PID:7312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
    3⤵
    PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46542.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16031.exe
      4⤵
      PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
      4⤵
      PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
    3⤵
    PID:1148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
    3⤵
    PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
    3⤵
    PID:6872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63921.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        6⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        5⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        6⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51191.exe
        5⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        5⤵
        
        PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
      4⤵
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        5⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
      4⤵
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
      4⤵
      PID:6240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
      4⤵
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50626.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56488.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38366.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7713.exe
        5⤵
        
        PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
      4⤵
      PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33391.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
    3⤵
    PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exe
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
      4⤵
      PID:7456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37741.exe
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
    3⤵
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27928.exe
    3⤵
    PID:5960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43584.exe
    3⤵
    PID:7172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
      4⤵
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
        5⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        5⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        5⤵
        
        PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56360.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
      4⤵
      PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe
      4⤵
      PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12383.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
      4⤵
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30453.exe
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
      4⤵
      PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
      4⤵
      PID:7744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
    3⤵
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
    3⤵
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
    3⤵
    PID:6220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
    3⤵
    PID:7576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exe
    3⤵
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16031.exe
      4⤵
      PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
    3⤵
    PID:4920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
    3⤵
    PID:7044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
  2⤵
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
    3⤵
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
    3⤵
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
    3⤵
    PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exe
    3⤵
    PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8306.exe
    3⤵
    PID:8068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
  2⤵
  PID:3088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
  2⤵
  PID:4428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9679.exe
  2⤵
  PID:6964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
  2⤵
  PID:8084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe

Filesize
468KB

MD5
8c9f8ddb2441140e9c0da6c76b76613d

SHA1
c76ede196ceec49fcf8c8f598547561362661cfd

SHA256
3765db2395cebf0cee71dda16d3fa7514619836472fbdfb9a46259b8bb1abb4f

SHA512
875975afb72a23ccf86b59e42fbc8924845c58ffc1a50ad7ffc01330cf73606c25d8d18281f7ed8d6a0f4c4147bed0fc5a98588ca4559cb52e89af450a9d0e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe

Filesize
468KB

MD5
89356cecae91496c4d64bc750c898b8a

SHA1
41e28965075c66c2096dc52da42732b2330930df

SHA256
bf92ebf05cefbbe80a16019cc0ea89b8a513dc15c23e2520078e0acc5aa12e6d

SHA512
ee184325caa7a2d516cfe4a590e861bd3313fb3dee55026164b11a2ba86ad1586827fe8c7ae52fe7f6f8add60de58aad375c0cf6803267b31d15d2d8f5d202d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe

Filesize
468KB

MD5
731a150ff08037de54dfe8f9a5063f8a

SHA1
b36ee224e6ae58c2a6be08d36cef4596da5798b4

SHA256
20558c146ef4daccca72e9a1bc18dd96d83dbbaeedd8c8a9a4b0270fe6796c3d

SHA512
f0cb64b2c8e452b55fe2e9d4dd11de505ebb2bce3bc54a60c61d4ccb16516819a4409c16371873e20c1cc9a70e676ea5344ce5177bbdd5424ff772a10a45d6a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe

Filesize
468KB

MD5
1381c1241601c29530fdeac8f7d77faf

SHA1
ffc717d06c9d177a34ef0b2468001fd9223054f3

SHA256
3a199992b390d279615e45625f01ed1daaef54cde09a5faa9e3180e199cb3f52

SHA512
ec3108ea87026a15976d4f823cd22431c84f957899f0e28dab425f5f4429fa074062e3b32cf86db3fbeede170a4218c469265772483241488d72e0ed1a22e8a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3110.exe

Filesize
468KB

MD5
201264b69fc190d6c305c4ebe52ebb59

SHA1
e87f78c34e526076e268de5218dd109f63ffe201

SHA256
03c59ea4668c2cd9debc1c3460d5459a02f23795013e7913435ef84de1b68169

SHA512
7531173fb13cd4ac26d65b346b514f2fa1f2d012f73e7b592c18873f66538395566b3233e602e10d469b44eade98149fa4947d167bb482fbaab472de7f56d81f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36940.exe

Filesize
468KB

MD5
f8759164c33ad0da4e5794582c5c06ff

SHA1
c159329f66e03a91b66df05694902c87a6db54f0

SHA256
85807c8f61994e2887ca0d26d307f9a5ace4bd7d857486f34ede3e5ea4ca3ace

SHA512
6cc3eaaed8292264db4fc5f2398bf5b59605a1409da753bf2deb9cf339fc554d79e01642648eb48bb91597a6cfc550a4d306cbc49dddfb692d169940ba46cb30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe

Filesize
468KB

MD5
0288c729bcf2b9a77c67a4010f77da4b

SHA1
e0e038c0f05da3b4ed80eab6ac284712394ab7d6

SHA256
0d1973707e135ce4eefc8a9f860d4c28f55a126be80a8f842e23b666636b1918

SHA512
5aa6801012d67a6d03ff7c5b874f6b51d23ce8c93abe6debb15979fcf991d1f82323e434f4e94b5ce7821f6a5af6eaa7a658a47bced2a0d796ce5787526c3ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39826.exe

Filesize
468KB

MD5
ce6331a0a1ce9e1c985dfa069c7c3b86

SHA1
97cb352db4f3ae7f653e264831c348512ba454c2

SHA256
6eece6d84ff1d2d99f34286902fc2ba073a9931f575b49b359eed569892eaa77

SHA512
e0723fe280f566a334491d1145987166636b7c1868b16e7e0f98cd96deb40d5193286b371c479d2978f2e14e415eed77d42457846c24f1b1b3d8a7ce1f281842

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe

Filesize
468KB

MD5
4c223c7be21c5b475a01447a59594b24

SHA1
cc4b37bcdd178e40b3ddf7dbe61c0d5550380fbe

SHA256
4d73097f0b97e46fd1324ac38677efe4eed1ccaf0c73a2ced9653ced15e97bd8

SHA512
ddcfa2e49fc6e7efd4a8794ef0d1cef32d83f7302cb855edf05c1342777ed5b7161b6b43905eb85c5652e484a9c2f685934d3d0a6858963bbe564a0e82ada620

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48947.exe

Filesize
468KB

MD5
35308ac54888b91a92d7d0a6b778c5da

SHA1
2c84a29a19fa8f5a60b40ab7d23d83286cf5d091

SHA256
3ca52fa8c9d1b67ca79808ff3b165ff1297b4f9c15026fc4dfb6a546cf8696af

SHA512
813de273b97842269eeea49fd78c1271bd74b4899a7e90d9680f67163da1507f4727f0d1cc14ca7085b3d10f54af519f59d6a5c33a15bef522e731cddf831abb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe

Filesize
468KB

MD5
ffffe63ee4b36ef421d67d5cb6bdd0e9

SHA1
d311934bf8d112ec925dab542f2aadb69309feac

SHA256
914e3ab3b8e47f0c31e1bf322d3f176f5a0ad992779520b5131dce5c4aca9c71

SHA512
7a3674bf6a38055724c0cc893e3dd048fbf11749d7ee8c25924d927c20e2cda1530ae37f2725d599e1895aaa81c7b57bc6e4cf5d0902d4320afcc4c50f035aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe

Filesize
468KB

MD5
78d538d9601557e9845e8669303a5263

SHA1
df407cc529eb235245c4d92f7997620b09b059f6

SHA256
8b058936264dc011946ff0962057053a402eee18be1f8b33c24b0002b8233618

SHA512
ae24d9ae2287be22922497a4dd04466e90c1db603114c9c375eeb533d678239362cb14be6ac1d985e1d03152a7a0285e02e3aebfb1a15d90c366ae12c619ae8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe

Filesize
468KB

MD5
29900131079750ae002abb85c41473b8

SHA1
0a83f14a25043c4d486823b053234aba4f39ff5b

SHA256
294471feceee9e56a7aa55ed8fce22fee8432d3e230903e7f0e8a20b66ebaf9e

SHA512
bf623412383700aff3097f33f8759dead0b5fa0358010ab8b7b5cfcd0c9b1370e36580352874b71c6580f73ec81ae345d560139f366e9965dad494682377a62e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe

Filesize
468KB

MD5
7cd12a1f9260af3ba8c24a558289791f

SHA1
2709c91da7765f26aff58267b20af52ecb826f01

SHA256
097373a6330b0ee423719ec36fefdc9a93ae86ad2db87e1679b15b2cc7e7ade5

SHA512
e13d66551625f093c3141e3efd0e386186c4d86086494b9f0dcceafe5fe479f6dad125a22c8f5a1137f943bc0f705d9107f5f00e0292df055fcf4b524463c7fe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14735.exe

Filesize
468KB

MD5
cc2d0a548233e98d7e7a28dd5d4c13b5

SHA1
3b76039c3b498b8fb2aa2eae1bff74e35a5f3ed2

SHA256
d87f4fd53f58dc68490908f4def87ffe7e9e97e332b426ace7157cd40c8d9690

SHA512
ffdd45b260f1ccbfe0e9b38eeaf1b1bc818e3f2aa0dd95cbfe6a1efc436b0bb22366d173c66100690a93e5e019f3db69b4285c09018ec37940e997e5361239cb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16768.exe

Filesize
468KB

MD5
ae10a382146e9e0af657e409a90d2ac9

SHA1
2b33666e85460a23d0637a64adcf5255f1578767

SHA256
974a1d9e506269c6fb118efb60b5e13e99501ccb610b4279428568663b55ad1a

SHA512
6e5364fae1d048ea936b31896e175cd34a98a5972b3bb9ae79dbb8a2a30cc59b8ba5bcd4d207209e6f57d6facf512ce374f5746ef652aa3f3799d773d2fe00ac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22899.exe

Filesize
468KB

MD5
b02d9fefb9142659debabf4287fe2f0f

SHA1
6140d01dee71c4c5e65cb96592c48de1e485b49c

SHA256
94be04058b47bf2d4e216b0c2e96e92c8d239a8515c66b97711d446a476dbec6

SHA512
b5b780981a3a3477ac5a56825cd116865136f1d7c940b51ff1d32cb51a585fb7d6ababfafb1feac70f0ad0d0dd64532f589b65ea2491abf37d0010cf995bf776

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe

Filesize
468KB

MD5
355c2060aec32a4deb26d7ad4934a8d3

SHA1
283dbfa79781fc47047e41a31e78287284aea069

SHA256
0bd31c9dd97bf4343a43bf2b0759055bbe3ca4b4a6f7ef7e20fbc97eac307044

SHA512
2b46212d1ff17c068fec6f2559862c5644b09a48e96d8dd3f82256b3b38d24f332fe69f300a1b5649093cf1c4b0aae6db15dd7b13a310cdffa6cd996b3d5f89b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3225.exe

Filesize
468KB

MD5
6f81b3a86a27dfc91271e69f5269bd8f

SHA1
b10c1b830e660c40da9c5e7028b23b9ebc5f4fd2

SHA256
11bb0de95cf74b4a48a3d5709722c468cf9551a432d1f046677ca7603517f908

SHA512
3a1d6e5fa475c2f39bb116eedfa15dc111236f3a49ec09892733937be72ce6b3cff1679c9134411807089dfabb82be30fcfb17eada52741ec98b88e5fe1554b6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33480.exe

Filesize
468KB

MD5
6bb9dc7cd3d1fd81d99131e24d784860

SHA1
675d56e65db9bffc543c13d9b455d61a0d008ed0

SHA256
9321f5aef4267e297f98d06c23f3c30a53747970fc37c39092185250415f943e

SHA512
9e229d54e2ec5ef0142d477b223b5d4ca4ce2df031c5a4500f9f86d2bc8306a9b762766f353b28ce1574b49c4b3d1fcfa6362fda5a7fcf326eab21caf66d1a27

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39235.exe

Filesize
468KB

MD5
ae5f4393a50f94e96094d6cd2f9879be

SHA1
f4d0e1b12abd2af31369465ab752762d4cd661bd

SHA256
fd4ce4255e7df8936fdcfb9392cafacd02971a154b9a43371b0b511dde65a74e

SHA512
cfd01d386248214e6aa5f7d243a81f40339b22e3dbf4340f62f03929f727596052f03adfc5888df3fc3f6ebfbe54ebca292278da086187726fb97b5a2dac47de

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe

Filesize
468KB

MD5
d0e73a9667b3a98f91a1b944ea3d7347

SHA1
443db0edd45027655139fd1e0c5a7aeec9e78af7

SHA256
c98e6b95221b15bc864cfb66fc339d0f328cfae78402f6ad8f05cdcfbac29b2d

SHA512
dab058a627dea9849298c89926ce15d8db340176521d9ee1a117ddd02aabecab49e632192fd6c66c2e3b8b52a82cdb8aa0cc0cf46d4320c840c60b7ef980aa6b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43105.exe

Filesize
468KB

MD5
a6e692e2e4dcf03091832d0dc945b962

SHA1
8340b4bd7eb4a60896a8af3af6bedd0f49c63b60

SHA256
99a82fc90787331257f4f57f4b7f213900f20ed8063d0916c6e8e40d66702739

SHA512
3e5cff44e0ee660718e672ad3ce35bbb219b0011bf4cf33dfc71321a06eca35628314e67c4d5a2cab61ed70793c5821a365976b4b37e62cad735ff24b5bc2a54

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe

Filesize
468KB

MD5
3f1f3e70b0384077b98d19e213c98b86

SHA1
d837d018387aeb57c4cbcf0487dace2658f66d1b

SHA256
ffc538121b600736cbcd9c50c371d1d8ceb83f853e0cc69a274a91222cfef66f

SHA512
3a07b34c903d6fbe46db0f6bb74a58011dc82950330add1799b846ee0cc41d10b5726ecdd2fabb0cb5c21121e646a52008770a68f8dcfe6fa274d52a54a735fb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47387.exe

Filesize
468KB

MD5
998dc8f7e1bd4ffd07a8f3d9e8f6073f

SHA1
50fd15a16907d8e349c549235883b579d7432ed1

SHA256
f081903f51b41ab55a9bf8b175dcf8c44e06bbdac75b6e111da9ab4b91f1380a

SHA512
0d82f777f5710d03886a86c05b15d8e0c821c4a6931799ae5a2379cf79d8a56f56a2775266ee3960f9225796326657d9b032f22158fdac6045dd832d596e5941

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe

Filesize
468KB

MD5
3aeedb233384361770a34fbe4bd1f98c

SHA1
a1c8fe0ca78afa41b889cd359daf7e53715781b7

SHA256
98f5c0d71e740ce522801f163d044d48c6c80456c1ecfd9d612e626d19cfd127

SHA512
bc63c960ab66c4560ea84da2476c91ac5850a50ecf56e162cb3895feb3139d35054e3d09aebf10f186a8407d736b3e1e81a3d3e675cc911920eed272ba90de74

Download Submit