bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
Size

468KB
MD5

285028c665106cfade8ca3aaacfd3e64
SHA1

a147e4f6955392143c91865717cf6ce480888a9a
SHA256

bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540
SHA512

2c574c6c9345648bc46bf80b72d1f135a98d9b7e79ba126e9658b4be1ad1392ee411d9e14fcbad25248b9c0dc0c9db4938fc7eb7c945247393d1c183f1bd9775
SSDEEP

3072:/bU4ogVd605ytbYEPIzhff8gg4bZW3pfdmHeVVVHEoWVxU/uIclM:/bToX8ytHPOhff6ZnFEoS6/uI

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2352	Unicorn-47471.exe
2480	Unicorn-6192.exe
1272	Unicorn-23223.exe
2688	Unicorn-42939.exe
2840	Unicorn-60728.exe
2744	Unicorn-40862.exe
2616	Unicorn-12195.exe
2580	Unicorn-18202.exe
2656	Unicorn-31584.exe
1944	Unicorn-51855.exe
828	Unicorn-51258.exe
2140	Unicorn-5155.exe
1884	Unicorn-2306.exe
1668	Unicorn-61978.exe
1168	Unicorn-39226.exe
1760	Unicorn-26036.exe
2876	Unicorn-59668.exe
2892	Unicorn-53538.exe
1932	Unicorn-40212.exe
1240	Unicorn-64494.exe
1292	Unicorn-23275.exe
1124	Unicorn-57779.exe
1464	Unicorn-59132.exe
1716	Unicorn-29902.exe
1680	Unicorn-29902.exe
892	Unicorn-20918.exe
1396	Unicorn-40784.exe
1436	Unicorn-63461.exe
2476	Unicorn-60794.exe
2448	Unicorn-44251.exe
1628	Unicorn-36777.exe
2184	Unicorn-50582.exe
864	Unicorn-11998.exe
2528	Unicorn-31864.exe
2916	Unicorn-32632.exe
2144	Unicorn-32367.exe
984	Unicorn-55324.exe
2168	Unicorn-11230.exe
2156	Unicorn-57074.exe
2824	Unicorn-47598.exe
2160	Unicorn-1926.exe
2760	Unicorn-45294.exe
2828	Unicorn-65159.exe
2684	Unicorn-17695.exe
2612	Unicorn-23826.exe
1636	Unicorn-198.exe
2008	Unicorn-34442.exe
2040	Unicorn-54308.exe
1560	Unicorn-4038.exe
1848	Unicorn-35018.exe
1712	Unicorn-26052.exe
2368	Unicorn-20218.exe
2372	Unicorn-20484.exe
2408	Unicorn-20484.exe
2976	Unicorn-55983.exe
2568	Unicorn-47614.exe
2424	Unicorn-25802.exe
1288	Unicorn-33725.exe
2276	Unicorn-47108.exe
1216	Unicorn-2396.exe
560	Unicorn-5971.exe
1180	Unicorn-39101.exe
600	Unicorn-37216.exe
1780	Unicorn-21530.exe

Loads dropped DLL 64 IoCs

pid	Process
2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
2352	Unicorn-47471.exe
2352	Unicorn-47471.exe
2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
2480	Unicorn-6192.exe
2480	Unicorn-6192.exe
1272	Unicorn-23223.exe
2352	Unicorn-47471.exe
2352	Unicorn-47471.exe
1272	Unicorn-23223.exe
2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
2840	Unicorn-60728.exe
2840	Unicorn-60728.exe
1272	Unicorn-23223.exe
1272	Unicorn-23223.exe
2688	Unicorn-42939.exe
2688	Unicorn-42939.exe
2616	Unicorn-12195.exe
2616	Unicorn-12195.exe
2480	Unicorn-6192.exe
2480	Unicorn-6192.exe
2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
2352	Unicorn-47471.exe
2352	Unicorn-47471.exe
2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
2744	Unicorn-40862.exe
2744	Unicorn-40862.exe
2656	Unicorn-31584.exe
2656	Unicorn-31584.exe
2580	Unicorn-18202.exe
2580	Unicorn-18202.exe
1272	Unicorn-23223.exe
1272	Unicorn-23223.exe
2840	Unicorn-60728.exe
2840	Unicorn-60728.exe
1884	Unicorn-2306.exe
1884	Unicorn-2306.exe
2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
2140	Unicorn-5155.exe
2140	Unicorn-5155.exe
2480	Unicorn-6192.exe
2480	Unicorn-6192.exe
1668	Unicorn-61978.exe
1944	Unicorn-51855.exe
1944	Unicorn-51855.exe
1668	Unicorn-61978.exe
2616	Unicorn-12195.exe
2616	Unicorn-12195.exe
828	Unicorn-51258.exe
828	Unicorn-51258.exe
2352	Unicorn-47471.exe
2352	Unicorn-47471.exe
2688	Unicorn-42939.exe
2688	Unicorn-42939.exe
1168	Unicorn-39226.exe
1168	Unicorn-39226.exe
2744	Unicorn-40862.exe
2744	Unicorn-40862.exe
1760	Unicorn-26036.exe
1760	Unicorn-26036.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3432	2212	WerFault.exe	198

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64434.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
2352	Unicorn-47471.exe
2480	Unicorn-6192.exe
1272	Unicorn-23223.exe
2840	Unicorn-60728.exe
2688	Unicorn-42939.exe
2616	Unicorn-12195.exe
2744	Unicorn-40862.exe
2580	Unicorn-18202.exe
2656	Unicorn-31584.exe
1884	Unicorn-2306.exe
1944	Unicorn-51855.exe
828	Unicorn-51258.exe
1668	Unicorn-61978.exe
2140	Unicorn-5155.exe
1168	Unicorn-39226.exe
1760	Unicorn-26036.exe
2876	Unicorn-59668.exe
2892	Unicorn-53538.exe
1932	Unicorn-40212.exe
1292	Unicorn-23275.exe
1124	Unicorn-57779.exe
1240	Unicorn-64494.exe
1464	Unicorn-59132.exe
1716	Unicorn-29902.exe
1680	Unicorn-29902.exe
1396	Unicorn-40784.exe
892	Unicorn-20918.exe
1436	Unicorn-63461.exe
2476	Unicorn-60794.exe
2448	Unicorn-44251.exe
1628	Unicorn-36777.exe
2184	Unicorn-50582.exe
864	Unicorn-11998.exe
2916	Unicorn-32632.exe
2144	Unicorn-32367.exe
984	Unicorn-55324.exe
2156	Unicorn-57074.exe
2168	Unicorn-11230.exe
2760	Unicorn-45294.exe
2828	Unicorn-65159.exe
2684	Unicorn-17695.exe
2824	Unicorn-47598.exe
2160	Unicorn-1926.exe
2612	Unicorn-23826.exe
1636	Unicorn-198.exe
2008	Unicorn-34442.exe
1560	Unicorn-4038.exe
2040	Unicorn-54308.exe
1712	Unicorn-26052.exe
1848	Unicorn-35018.exe
2368	Unicorn-20218.exe
2408	Unicorn-20484.exe
2372	Unicorn-20484.exe
2976	Unicorn-55983.exe
2568	Unicorn-47614.exe
2424	Unicorn-25802.exe
2276	Unicorn-47108.exe
1288	Unicorn-33725.exe
1216	Unicorn-2396.exe
560	Unicorn-5971.exe
1180	Unicorn-39101.exe
600	Unicorn-37216.exe
1780	Unicorn-21530.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2352	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	30
PID 2960 wrote to memory of 2352	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	30
PID 2960 wrote to memory of 2352	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	30
PID 2960 wrote to memory of 2352	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	30
PID 2352 wrote to memory of 2480	2352	Unicorn-47471.exe	32
PID 2352 wrote to memory of 2480	2352	Unicorn-47471.exe	32
PID 2352 wrote to memory of 2480	2352	Unicorn-47471.exe	32
PID 2352 wrote to memory of 2480	2352	Unicorn-47471.exe	32
PID 2960 wrote to memory of 1272	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	33
PID 2960 wrote to memory of 1272	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	33
PID 2960 wrote to memory of 1272	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	33
PID 2960 wrote to memory of 1272	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	33
PID 2480 wrote to memory of 2688	2480	Unicorn-6192.exe	34
PID 2480 wrote to memory of 2688	2480	Unicorn-6192.exe	34
PID 2480 wrote to memory of 2688	2480	Unicorn-6192.exe	34
PID 2480 wrote to memory of 2688	2480	Unicorn-6192.exe	34
PID 2352 wrote to memory of 2744	2352	Unicorn-47471.exe	36
PID 2352 wrote to memory of 2744	2352	Unicorn-47471.exe	36
PID 2352 wrote to memory of 2744	2352	Unicorn-47471.exe	36
PID 2352 wrote to memory of 2744	2352	Unicorn-47471.exe	36
PID 1272 wrote to memory of 2840	1272	Unicorn-23223.exe	35
PID 1272 wrote to memory of 2840	1272	Unicorn-23223.exe	35
PID 1272 wrote to memory of 2840	1272	Unicorn-23223.exe	35
PID 1272 wrote to memory of 2840	1272	Unicorn-23223.exe	35
PID 2960 wrote to memory of 2616	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	37
PID 2960 wrote to memory of 2616	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	37
PID 2960 wrote to memory of 2616	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	37
PID 2960 wrote to memory of 2616	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	37
PID 2840 wrote to memory of 2580	2840	Unicorn-60728.exe	38
PID 2840 wrote to memory of 2580	2840	Unicorn-60728.exe	38
PID 2840 wrote to memory of 2580	2840	Unicorn-60728.exe	38
PID 2840 wrote to memory of 2580	2840	Unicorn-60728.exe	38
PID 1272 wrote to memory of 2656	1272	Unicorn-23223.exe	39
PID 1272 wrote to memory of 2656	1272	Unicorn-23223.exe	39
PID 1272 wrote to memory of 2656	1272	Unicorn-23223.exe	39
PID 1272 wrote to memory of 2656	1272	Unicorn-23223.exe	39
PID 2688 wrote to memory of 828	2688	Unicorn-42939.exe	40
PID 2688 wrote to memory of 828	2688	Unicorn-42939.exe	40
PID 2688 wrote to memory of 828	2688	Unicorn-42939.exe	40
PID 2688 wrote to memory of 828	2688	Unicorn-42939.exe	40
PID 2616 wrote to memory of 1944	2616	Unicorn-12195.exe	41
PID 2616 wrote to memory of 1944	2616	Unicorn-12195.exe	41
PID 2616 wrote to memory of 1944	2616	Unicorn-12195.exe	41
PID 2616 wrote to memory of 1944	2616	Unicorn-12195.exe	41
PID 2480 wrote to memory of 2140	2480	Unicorn-6192.exe	42
PID 2480 wrote to memory of 2140	2480	Unicorn-6192.exe	42
PID 2480 wrote to memory of 2140	2480	Unicorn-6192.exe	42
PID 2480 wrote to memory of 2140	2480	Unicorn-6192.exe	42
PID 2352 wrote to memory of 1668	2352	Unicorn-47471.exe	44
PID 2960 wrote to memory of 1884	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	43
PID 2352 wrote to memory of 1668	2352	Unicorn-47471.exe	44
PID 2960 wrote to memory of 1884	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	43
PID 2352 wrote to memory of 1668	2352	Unicorn-47471.exe	44
PID 2960 wrote to memory of 1884	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	43
PID 2352 wrote to memory of 1668	2352	Unicorn-47471.exe	44
PID 2960 wrote to memory of 1884	2960	bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe	43
PID 2744 wrote to memory of 1168	2744	Unicorn-40862.exe	45
PID 2744 wrote to memory of 1168	2744	Unicorn-40862.exe	45
PID 2744 wrote to memory of 1168	2744	Unicorn-40862.exe	45
PID 2744 wrote to memory of 1168	2744	Unicorn-40862.exe	45
PID 2656 wrote to memory of 1760	2656	Unicorn-31584.exe	46
PID 2656 wrote to memory of 1760	2656	Unicorn-31584.exe	46
PID 2656 wrote to memory of 1760	2656	Unicorn-31584.exe	46
PID 2656 wrote to memory of 1760	2656	Unicorn-31584.exe	46

C:\Users\Admin\AppData\Local\Temp\bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe
"C:\Users\Admin\AppData\Local\Temp\bf7af8e856c94dbe9658db590a5b78a957027a6ab22b748c3c90fa5904a0b540.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47471.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47471.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51258.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40784.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-198.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3409.exe
        8⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        8⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        8⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        8⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        8⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        8⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        7⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        8⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        8⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5626.exe
        8⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        8⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe
        8⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        7⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
        7⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27590.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        7⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        6⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        6⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        6⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43273.exe
        6⤵
        
        PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60794.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49536.exe
        7⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        7⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        7⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47704.exe
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        6⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        6⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        6⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19917.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44515.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24057.exe
        7⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        6⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34995.exe
        6⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8800.exe
        5⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe
        6⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14972.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        5⤵
        
        PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23826.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe
        7⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5225.exe
        8⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
        9⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        9⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        9⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        9⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        9⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        8⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        8⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        8⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        7⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        6⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        7⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37060.exe
        6⤵
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31013.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        6⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        6⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41951.exe
        6⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48621.exe
        7⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        6⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exe
        6⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        5⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34995.exe
        6⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22347.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51528.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59132.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46837.exe
        6⤵
        
        PID:660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        6⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        5⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        5⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        5⤵
        
        PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35365.exe
        5⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
        6⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
      4⤵
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61142.exe
        5⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
        5⤵
        
        PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
      4⤵
      PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
      4⤵
      PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
      4⤵
      PID:7504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44251.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33725.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        7⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
        7⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        7⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
        6⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        6⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        6⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49536.exe
        6⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe
        6⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61439.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56992.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34000.exe
        5⤵
        
        PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2396.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        6⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
        5⤵
        
        PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33309.exe
        5⤵
        
        PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        5⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        5⤵
        
        PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10621.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61262.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
      4⤵
      PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1806.exe
      4⤵
      PID:7328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61978.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57074.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35365.exe
        6⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
        7⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34481.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        6⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21787.exe
        6⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        5⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        6⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
        6⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        5⤵
        
        PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        5⤵
        
        PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        5⤵
        
        PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        5⤵
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4278.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        5⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23770.exe
      4⤵
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        5⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8071.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18232.exe
        5⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        5⤵
        
        PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48221.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43104.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
      4⤵
      PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
      4⤵
      PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62130.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        5⤵
        
        PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
      4⤵
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        5⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
        5⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16675.exe
        5⤵
        
        PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
      4⤵
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
      4⤵
      PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
      4⤵
      PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
      4⤵
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        5⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32887.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38907.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15625.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
      4⤵
      PID:328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31013.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exe
      4⤵
      PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
      4⤵
      PID:7828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
    3⤵
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
    3⤵
    PID:2212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 188
      4⤵
      Program crash
      PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
    3⤵
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exe
    3⤵
    PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62408.exe
    3⤵
    PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31098.exe
    3⤵
    PID:6240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
    3⤵
    PID:7888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60728.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22016.exe
        6⤵
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15081.exe
        7⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        7⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
        6⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        6⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42477.exe
        6⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33829.exe
        6⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5626.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        7⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49749.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        6⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1025.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12556.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        6⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
        5⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43937.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        5⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        5⤵
        
        PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20484.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        6⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32847.exe
        7⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1746.exe
        7⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
        6⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        6⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        6⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        5⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        6⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        6⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
        6⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26559.exe
        5⤵
        
        PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        5⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exe
        5⤵
        
        PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
      4⤵
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16153.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65409.exe
        5⤵
        
        PID:7760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
      4⤵
      PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61262.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
      4⤵
      PID:7612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39101.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
        7⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27071.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        7⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25342.exe
        7⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        6⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        6⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11336.exe
        6⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10873.exe
        5⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        5⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        5⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25342.exe
        5⤵
        
        PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        6⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        6⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        6⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
        5⤵
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
      4⤵
      PID:284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35246.exe
        5⤵
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        6⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65485.exe
        6⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
        5⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        5⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        5⤵
        
        PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46439.exe
      4⤵
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        5⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
        5⤵
        
        PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42354.exe
      4⤵
      PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43104.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
      4⤵
      PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63543.exe
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
      4⤵
      PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe
      4⤵
      PID:7584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53538.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
      4⤵
      Executes dropped EXE
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
        5⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        6⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17973.exe
        6⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        5⤵
        
        PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        5⤵
        
        PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27040.exe
      4⤵
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
        5⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34464.exe
        5⤵
        
        PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55614.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
      4⤵
      PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
      4⤵
      PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
      4⤵
      PID:7748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
      4⤵
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18232.exe
        5⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
        5⤵
        
        PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
      4⤵
      PID:6304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53392.exe
    3⤵
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
      4⤵
      PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
      4⤵
      PID:6280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52526.exe
    3⤵
    PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
    3⤵
    PID:6996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42742.exe
    3⤵
    PID:6308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        6⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56882.exe
        7⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        6⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        5⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63641.exe
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        6⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        6⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        6⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        5⤵
        
        PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31013.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        5⤵
        
        PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45294.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11275.exe
        5⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18232.exe
        6⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
        6⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        5⤵
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        5⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        5⤵
        
        PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6131.exe
      4⤵
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36720.exe
        5⤵
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52104.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10790.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        6⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
        5⤵
        
        PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52106.exe
        5⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        5⤵
        
        PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37441.exe
      4⤵
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        5⤵
        
        PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
      4⤵
      PID:464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48083.exe
      4⤵
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
      4⤵
      PID:7264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20484.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        5⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1101.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65485.exe
        6⤵
        
        PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        5⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        5⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
      4⤵
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9398.exe
        5⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        5⤵
        
        PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59616.exe
      4⤵
      PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55614.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
      4⤵
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
      4⤵
      PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
      4⤵
      PID:7288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
      4⤵
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
        5⤵
        
        PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        5⤵
        
        PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43775.exe
      4⤵
      PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
      4⤵
      PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14151.exe
      4⤵
      PID:7840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50222.exe
    3⤵
    PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18896.exe
      4⤵
      PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50953.exe
      4⤵
      PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe
      4⤵
      PID:8120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
    3⤵
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30618.exe
    3⤵
    PID:4344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9241.exe
    3⤵
    PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
    3⤵
    PID:7272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47614.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        5⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        6⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exe
        5⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        5⤵
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        5⤵
        
        PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41492.exe
      4⤵
      PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43104.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
      4⤵
      PID:7628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
      4⤵
      PID:620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
      4⤵
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
      4⤵
      PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
      4⤵
      PID:8000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
    3⤵
    PID:3152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
    3⤵
    PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4077.exe
    3⤵
    PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
    3⤵
    PID:6344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
    3⤵
    PID:7868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23275.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
      4⤵
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        5⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48873.exe
        5⤵
        
        PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
      4⤵
      PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
      4⤵
      PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
      4⤵
      PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
      4⤵
      PID:7704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
    3⤵
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
      4⤵
      PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
      4⤵
      PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
      4⤵
      PID:7768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
    3⤵
    PID:2592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
    3⤵
    PID:3124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
    3⤵
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
    3⤵
    PID:6588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59968.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55324.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55324.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
    3⤵
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43190.exe
      4⤵
      PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
      4⤵
      PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
      4⤵
      PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
      4⤵
      PID:7708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
    3⤵
    PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
    3⤵
    PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
    3⤵
    PID:7804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37110.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37110.exe
  2⤵
  PID:1700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exe
    3⤵
    PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
    3⤵
    PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
    3⤵
    PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18218.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18218.exe
  2⤵
  PID:2292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5346.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5346.exe
  2⤵
  PID:3160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
  2⤵
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
  2⤵
  PID:5452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12897.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12897.exe
  2⤵
  PID:6228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29349.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29349.exe
  2⤵
  PID:7860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe

Filesize
468KB

MD5
658bf846de539adc3cf50be02363808f

SHA1
b11c37c30eed643c7fc359638e89b6755b776b63

SHA256
3b262d0c46b1063636886f2182e52fe41c643aef5239403512566714092c453e

SHA512
96c37d5bcef5392b1182e34776b457fd0afa89ac60ac0f277ce0b9080c53ee9e0ceb1a199ad58210c2dc385ca764fe1de0c616f2ed77acb3cdefea5483c89fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe

Filesize
468KB

MD5
3433064307ccd2a86d9c011411d02cfb

SHA1
40269cac47f09c6ae3d4bf396f85ec3060d97e83

SHA256
46cfe90105b8e26f5747908c25044783982a39ae9b37b8b38425f65ffbca0661

SHA512
7c65f708ca23ad829a77d22067fc2490c5c7315a033bef6976ee9d2efd53a94497652f4b4833c350a673dcc3cc92546bf74ff747599bcc663ae026b4286551e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe

Filesize
468KB

MD5
3e466279ba17c72bf49ac82bdafacb22

SHA1
a10b75f62aca3a906583821a6a88ea94cda8d70c

SHA256
a90e5738dcc7fb231c80f8f681391efc3d08d6acd6a6b4fc02e993c6dbc82afa

SHA512
32a430c9627841240dc466352f5ba55eb4261f463a1c82bd062c6a10136e43ce9bc371958d1355796b8c57f49549fa215958b5eab4956f1e2a072903300f2ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe

Filesize
468KB

MD5
41e60e95ebde1dbb3c922c0e2ddd87fc

SHA1
13ba29ac13b18f49c29925a0dff82ac5114e83df

SHA256
298816523907746a280bf067305677eb8234e9292ef2600ab4378b1c398697a0

SHA512
6f9dee97352a0e393fe4b3ecc3bede9ffb1ef143b6cd1eabc7ba376e261b6cf6009b3c53060da10f093e7ecfad91ade71b89c238d3d94342e19597fdee67354a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47471.exe

Filesize
468KB

MD5
301233af757db94a6cb9fd5fbd30d5b6

SHA1
e10a55f38868cf980be19ba75cc01ec879ef0c4e

SHA256
fb8bb0c8f07630e30d4603c3de3e6e9b792b72bea90d04802effcd1837c0365f

SHA512
828e54e756a4b2860cb0053087663b835b52f94b4d8e7fd8acf2433673b76cd055ebc00941a38e09cbf703669cdab2e380dee51ec2ecbcfae3a08b1a575b518b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51258.exe

Filesize
468KB

MD5
c3ddcb40c4b3e6e9f05e8664e009ef1d

SHA1
4a72ddf4794d6699da8b56b3f0b8fb34b5813fcf

SHA256
e069a6dc95df35b27b63e0477ba76e7090cbf45ea4e3a8e63d8db8720842e398

SHA512
ea02c9f3d404c0b72fd9a25540e7d40104b94958a5c94bcd00311eccc6f7eef1e165f0a8f7ec0cf08056e17986fc49c8ac62232dbbf63252e78a7c174ffa4907

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe

Filesize
468KB

MD5
5ae4cdd93e52bdadfa9704e6a1d49982

SHA1
0a3bd333684cee3e46740419df3782ccbef6cad2

SHA256
b9cf53f62deb7e9cad43f2cb9d9aeae0d54e2293fb37a3d7cf4524b0fdb26981

SHA512
887f050e2c9c2cc1218592ba98e5192df4d7c874640978f720d4c2e92a41f73937a0d716fd6ca0a9f4c0e48f46944000a44b9151199732e4b289822ddd626580

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53538.exe

Filesize
468KB

MD5
715807cad9915345543e3a8010655479

SHA1
1c795332fdcfc35005bd1f4e10eddfb811a2c1e8

SHA256
a64af489ac11b1afdd698d4d8802508e40d3196ad720cb51aa5f8438c6077174

SHA512
1c59000b393ca18ace8408fd2ff55ceb46081fa5fa8d64d43a0508b54320f332428735084e15b521c0c03e1e1456977710f84bd1e0f804535f96da4338b6a507

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe

Filesize
468KB

MD5
61fd23e3f354f59041047f4954f72f90

SHA1
705818f7dc4dca683cc5f42f4382cf79c3193691

SHA256
ac1322183217006260ec75b0f0c48e36ad869452e0121b4eeb8312edaa806391

SHA512
3f63bdfab925e46cdbdeb8dbc3ec466e5516d833b654a713503e903f009acd429bef628236c2189d5a50ebd54e603c03710116eff66ddc138ceda4027786236a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61978.exe

Filesize
468KB

MD5
fc88e92f743a01005c1c3b5132794cee

SHA1
a58eac5dcb2d066a183a74e9ef5d58ce01a2a46b

SHA256
2e81750d97d324864107a1ea93f7ab8ae23451848393ad19143c589d6ebf8685

SHA512
a518bc661cc9e08a3a7026990b597d6103b51b1295c3c27a021d98026251039d0bbfd9e1f419ff10c9d0fdc4ce36ce35d8b0c96b8b9fd0c44060fca51a7806d1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe

Filesize
468KB

MD5
0eb37c86c4acf62d5d254d04aae4b5fc

SHA1
5547e0c668dc47a2fc31c4d64a0070c095a7f48a

SHA256
c0158fe3a2c62db6a00399bce9c785bc3277c87e4761988aaa52d69dbbaa8670

SHA512
9216cd8dfe922d16ab127dda9d166fd346158e453d530f8da70d150a82f9c9f216c7b48bf6ffcd14ef36081b1d9b84908e7c3274e0d6a89e492f51b089f12b6c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe

Filesize
468KB

MD5
8bf7fc22cce1052e52d954f80f89507c

SHA1
d40d000838d674c2287b58b819da4f0ef9499370

SHA256
b632de6e9d1a927d62a3e3cf587809728af775ff80d886f9fd736f780bb93136

SHA512
7b27c641c5d21d31a398feb58db774e5b3807bbd671617d098d82eb1aeb48cdb934ba2a47983c779706a72d169649938f06d6317f684a22e79612a24ebc56d7b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe

Filesize
468KB

MD5
a32a51fb3f7a6f932c55f212794fa2b7

SHA1
2e8eb040dcc28c04354ded0337784545d5258fd2

SHA256
6f16b30ac3b78de9c3780233bd906949627062db37c28ce51f52cfce7a4cbc72

SHA512
e8f99f632979a6039d2d9bb5d7cc986332cf3c4f50365cb8b8a486a9cb67819f5b8caebe5bf972cacdabaa68759a992cec0a13bfabf4599844b57bf0d585b8c3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe

Filesize
468KB

MD5
cd8e57e81a03b41a4d3a74d3513b0a65

SHA1
6afb6d691765a089384e5e65803aa5e8ee358747

SHA256
f98d1f75d8c4866aea84c9463ae69af55b05acb5776cfbb7c4f6f2c033ad15f3

SHA512
f31f0977b5f0612c74d6dcd618e588927186981983f7cf28058e790742c704eee9662aff98d0862a80d260061df1ba1801ef14c50f2e7f4eef7d529fe921d007

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe

Filesize
468KB

MD5
65ba963cc035ac0fe42403b2803a50cd

SHA1
20b566c5253319b6198133e15c4f299b0d9fa752

SHA256
ba25b8c84b40dc61bb32e47e282d58dc6b19a5295267eecd74e9717a64515de3

SHA512
d461d04812348edfe8f791e2ad7a9282cef5eaad5da66b4edce078a2b8f54909e426147b1f392c7a2b3af22f79a19b50fc4dfdf5ce443db7371f8aa6267bebe5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe

Filesize
468KB

MD5
294659c2f5dc5a5ca6648d5f69dfdbcc

SHA1
27e2229453f006e62b15530f700253418adba40a

SHA256
c526fec0becdb04c82f089ceff9189a892b06865d25049f5ea7cf10d6df5457b

SHA512
c46e68ce7a91866b42a7e0ac3e2eeb27a1842bad4f5481c6f046bf90afddc04ba9ac2c051abace26176a203ffab0f5f34e1b7eb808ffca96c24e604181e84700

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe

Filesize
468KB

MD5
2edb5a5b8d3fa5067d722fe68d142a44

SHA1
354c91be9d426846479b0b1e2039d9a7b20dac4e

SHA256
8b2a55fef5b5dd9390108cfe1a32a0d1469a811b10e7aaed9b52dd8672bc8057

SHA512
a9bd9792556246d5ed95e83f2e4061328f6d74a853094282a0f74507d9b176e79934f2f9a1aed63bf9bc6691acfca454e44abeb279739e2feb387fd487691945

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe

Filesize
468KB

MD5
1235fd9994d97e2fde9233d3a619ca38

SHA1
c6b79e9a4be187e1baf6bb39b4fe6deddb51ecbe

SHA256
5eb81107b00b9fb1cfe7d69f474c761b76a316bf7d5555f83b3fb021ad27b444

SHA512
e8956363d38b0f12eb4f2e603362ecc64e371d39abe2c3dc990fc3a8f3362726308bc3956f4558f5a888524d9ff227de59499eb02b9ab8f7a0456264e924bf6a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe

Filesize
468KB

MD5
0d47191c37fbdd901b13351344c9685a

SHA1
cd3ba974812b28543413d93f87799c90a7988d2c

SHA256
fa9d2a2b7e31527db60dd4a0aeb040ca245c43f2a8e90fbd7c3ccefb31d596e8

SHA512
091ac7c56940ce31ebdc5fa7cab9ab06e23b37d4120d086d3edd8a670c3aa392279f3408a929d519d0b54ed50412eb50870cb3e923bbd968fafe78256c27de42

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60728.exe

Filesize
468KB

MD5
55c1262a3d7c90d8385de488f77f3f80

SHA1
ec99a022d718c92e293ded43bec5e1ed8ae4e8ea

SHA256
674400e4db412dbd24e8495193c07e7c3eb562ebe16934a3c52df24e67e65124

SHA512
3fc6c991bdbc0bf2eb59112bae95d929b88bc755d2555357c8d4574edccbf4a46b2c3bf566005fac3b9738d9ab0b6675994c17f9f7402e8b44a531ba2ef57ffe

Download Submit