69d866980eecd4c4bc7fa83ea7c67fd24b5aa6d681ce5b5c60d955a7b8888a23

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan.Win32.Fareit.VB.exe
Size

468KB
MD5

fde7e732b04d9c036c46c7d3b8e6f470
SHA1

f3335125190ac891320091db11abfb747a75b481
SHA256

69d866980eecd4c4bc7fa83ea7c67fd24b5aa6d681ce5b5c60d955a7b8888a23
SHA512

73498cb3e947aca1f8980aa51456d0b9fdf28a6986182b5d9782b6a9395a98167ad2b2b3d14719995aa56a2d9468259bb1c49207225321029d7276f2e69a5162
SSDEEP

3072:MTANoSCVId5UtbY2Pztjcf8/SCMvPgpwVmHeevsUPxo8j7yCQflH:MTqoQbUtlPJjcfbcQGPx5/yCQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2696	Unicorn-15622.exe
2664	Unicorn-33359.exe
2780	Unicorn-29061.exe
2768	Unicorn-38917.exe
2616	Unicorn-40955.exe
2552	Unicorn-10883.exe
2968	Unicorn-47085.exe
2360	Unicorn-11693.exe
1936	Unicorn-57941.exe
1552	Unicorn-14189.exe
2836	Unicorn-30526.exe
2864	Unicorn-30261.exe
2576	Unicorn-22358.exe
2256	Unicorn-7867.exe
984	Unicorn-59669.exe
2172	Unicorn-58943.exe
3012	Unicorn-6213.exe
580	Unicorn-17719.exe
804	Unicorn-46565.exe
2484	Unicorn-19639.exe
2488	Unicorn-59333.exe
1484	Unicorn-19063.exe
1784	Unicorn-59903.exe
1556	Unicorn-40037.exe
2832	Unicorn-27807.exe
2084	Unicorn-27542.exe
2392	Unicorn-65118.exe
2628	Unicorn-19447.exe
2924	Unicorn-12247.exe
1716	Unicorn-18378.exe
996	Unicorn-64926.exe
308	Unicorn-10204.exe
2456	Unicorn-39347.exe
1608	Unicorn-50853.exe
2648	Unicorn-26349.exe
2888	Unicorn-45299.exe
2692	Unicorn-5990.exe
2564	Unicorn-2228.exe
2764	Unicorn-10396.exe
2588	Unicorn-25399.exe
2044	Unicorn-21366.exe
2604	Unicorn-32872.exe
2352	Unicorn-24512.exe
2364	Unicorn-64583.exe
2636	Unicorn-46063.exe
2292	Unicorn-10671.exe
568	Unicorn-64319.exe
1880	Unicorn-52088.exe
2372	Unicorn-18958.exe
2128	Unicorn-19224.exe
968	Unicorn-43728.exe
2196	Unicorn-4733.exe
2228	Unicorn-10863.exe
2248	Unicorn-10863.exe
1656	Unicorn-39046.exe
3048	Unicorn-46146.exe
3020	Unicorn-42083.exe
1044	Unicorn-42083.exe
1760	Unicorn-32960.exe
1876	Unicorn-2896.exe
2020	Unicorn-62377.exe
1364	Unicorn-60806.exe
1052	Unicorn-24412.exe
1920	Unicorn-60614.exe

Loads dropped DLL 64 IoCs

pid	Process
3068	Trojan.Win32.Fareit.VB.exe
3068	Trojan.Win32.Fareit.VB.exe
2696	Unicorn-15622.exe
2696	Unicorn-15622.exe
3068	Trojan.Win32.Fareit.VB.exe
3068	Trojan.Win32.Fareit.VB.exe
2664	Unicorn-33359.exe
2664	Unicorn-33359.exe
2696	Unicorn-15622.exe
3068	Trojan.Win32.Fareit.VB.exe
2780	Unicorn-29061.exe
2696	Unicorn-15622.exe
3068	Trojan.Win32.Fareit.VB.exe
2780	Unicorn-29061.exe
2768	Unicorn-38917.exe
2768	Unicorn-38917.exe
2664	Unicorn-33359.exe
2664	Unicorn-33359.exe
2616	Unicorn-40955.exe
2616	Unicorn-40955.exe
2552	Unicorn-10883.exe
2552	Unicorn-10883.exe
3068	Trojan.Win32.Fareit.VB.exe
3068	Trojan.Win32.Fareit.VB.exe
2968	Unicorn-47085.exe
2968	Unicorn-47085.exe
2696	Unicorn-15622.exe
2780	Unicorn-29061.exe
2696	Unicorn-15622.exe
2780	Unicorn-29061.exe
2360	Unicorn-11693.exe
2360	Unicorn-11693.exe
2768	Unicorn-38917.exe
2768	Unicorn-38917.exe
1936	Unicorn-57941.exe
1936	Unicorn-57941.exe
2664	Unicorn-33359.exe
2664	Unicorn-33359.exe
2864	Unicorn-30261.exe
2864	Unicorn-30261.exe
3068	Trojan.Win32.Fareit.VB.exe
3068	Trojan.Win32.Fareit.VB.exe
2836	Unicorn-30526.exe
2836	Unicorn-30526.exe
2552	Unicorn-10883.exe
2256	Unicorn-7867.exe
2552	Unicorn-10883.exe
2256	Unicorn-7867.exe
2696	Unicorn-15622.exe
1552	Unicorn-14189.exe
2696	Unicorn-15622.exe
1552	Unicorn-14189.exe
2616	Unicorn-40955.exe
984	Unicorn-59669.exe
2616	Unicorn-40955.exe
984	Unicorn-59669.exe
2780	Unicorn-29061.exe
2780	Unicorn-29061.exe
2576	Unicorn-22358.exe
2576	Unicorn-22358.exe
2968	Unicorn-47085.exe
2968	Unicorn-47085.exe
2172	Unicorn-58943.exe
2172	Unicorn-58943.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44516.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3068	Trojan.Win32.Fareit.VB.exe
2696	Unicorn-15622.exe
2664	Unicorn-33359.exe
2780	Unicorn-29061.exe
2768	Unicorn-38917.exe
2616	Unicorn-40955.exe
2552	Unicorn-10883.exe
2968	Unicorn-47085.exe
2360	Unicorn-11693.exe
1936	Unicorn-57941.exe
2836	Unicorn-30526.exe
2864	Unicorn-30261.exe
1552	Unicorn-14189.exe
984	Unicorn-59669.exe
2256	Unicorn-7867.exe
2576	Unicorn-22358.exe
2172	Unicorn-58943.exe
3012	Unicorn-6213.exe
580	Unicorn-17719.exe
804	Unicorn-46565.exe
2484	Unicorn-19639.exe
2488	Unicorn-59333.exe
1484	Unicorn-19063.exe
1784	Unicorn-59903.exe
2084	Unicorn-27542.exe
2832	Unicorn-27807.exe
1556	Unicorn-40037.exe
2628	Unicorn-19447.exe
2392	Unicorn-65118.exe
2924	Unicorn-12247.exe
1716	Unicorn-18378.exe
996	Unicorn-64926.exe
308	Unicorn-10204.exe
2456	Unicorn-39347.exe
2648	Unicorn-26349.exe
1608	Unicorn-50853.exe
2888	Unicorn-45299.exe
2692	Unicorn-5990.exe
2564	Unicorn-2228.exe
2764	Unicorn-10396.exe
2588	Unicorn-25399.exe
2044	Unicorn-21366.exe
2604	Unicorn-32872.exe
2364	Unicorn-64583.exe
2352	Unicorn-24512.exe
2636	Unicorn-46063.exe
2292	Unicorn-10671.exe
1880	Unicorn-52088.exe
568	Unicorn-64319.exe
2128	Unicorn-19224.exe
2372	Unicorn-18958.exe
968	Unicorn-43728.exe
2196	Unicorn-4733.exe
2228	Unicorn-10863.exe
2248	Unicorn-10863.exe
3048	Unicorn-46146.exe
1656	Unicorn-39046.exe
3020	Unicorn-42083.exe
1044	Unicorn-42083.exe
1760	Unicorn-32960.exe
1876	Unicorn-2896.exe
2020	Unicorn-62377.exe
1364	Unicorn-60806.exe
1052	Unicorn-24412.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2696	3068	Trojan.Win32.Fareit.VB.exe	30
PID 3068 wrote to memory of 2696	3068	Trojan.Win32.Fareit.VB.exe	30
PID 3068 wrote to memory of 2696	3068	Trojan.Win32.Fareit.VB.exe	30
PID 3068 wrote to memory of 2696	3068	Trojan.Win32.Fareit.VB.exe	30
PID 2696 wrote to memory of 2664	2696	Unicorn-15622.exe	31
PID 2696 wrote to memory of 2664	2696	Unicorn-15622.exe	31
PID 2696 wrote to memory of 2664	2696	Unicorn-15622.exe	31
PID 2696 wrote to memory of 2664	2696	Unicorn-15622.exe	31
PID 3068 wrote to memory of 2780	3068	Trojan.Win32.Fareit.VB.exe	32
PID 3068 wrote to memory of 2780	3068	Trojan.Win32.Fareit.VB.exe	32
PID 3068 wrote to memory of 2780	3068	Trojan.Win32.Fareit.VB.exe	32
PID 3068 wrote to memory of 2780	3068	Trojan.Win32.Fareit.VB.exe	32
PID 2664 wrote to memory of 2768	2664	Unicorn-33359.exe	33
PID 2664 wrote to memory of 2768	2664	Unicorn-33359.exe	33
PID 2664 wrote to memory of 2768	2664	Unicorn-33359.exe	33
PID 2664 wrote to memory of 2768	2664	Unicorn-33359.exe	33
PID 2696 wrote to memory of 2552	2696	Unicorn-15622.exe	34
PID 2696 wrote to memory of 2552	2696	Unicorn-15622.exe	34
PID 2696 wrote to memory of 2552	2696	Unicorn-15622.exe	34
PID 2696 wrote to memory of 2552	2696	Unicorn-15622.exe	34
PID 3068 wrote to memory of 2616	3068	Trojan.Win32.Fareit.VB.exe	35
PID 3068 wrote to memory of 2616	3068	Trojan.Win32.Fareit.VB.exe	35
PID 3068 wrote to memory of 2616	3068	Trojan.Win32.Fareit.VB.exe	35
PID 3068 wrote to memory of 2616	3068	Trojan.Win32.Fareit.VB.exe	35
PID 2780 wrote to memory of 2968	2780	Unicorn-29061.exe	36
PID 2780 wrote to memory of 2968	2780	Unicorn-29061.exe	36
PID 2780 wrote to memory of 2968	2780	Unicorn-29061.exe	36
PID 2780 wrote to memory of 2968	2780	Unicorn-29061.exe	36
PID 2768 wrote to memory of 2360	2768	Unicorn-38917.exe	37
PID 2768 wrote to memory of 2360	2768	Unicorn-38917.exe	37
PID 2768 wrote to memory of 2360	2768	Unicorn-38917.exe	37
PID 2768 wrote to memory of 2360	2768	Unicorn-38917.exe	37
PID 2664 wrote to memory of 1936	2664	Unicorn-33359.exe	38
PID 2664 wrote to memory of 1936	2664	Unicorn-33359.exe	38
PID 2664 wrote to memory of 1936	2664	Unicorn-33359.exe	38
PID 2664 wrote to memory of 1936	2664	Unicorn-33359.exe	38
PID 2616 wrote to memory of 1552	2616	Unicorn-40955.exe	39
PID 2616 wrote to memory of 1552	2616	Unicorn-40955.exe	39
PID 2616 wrote to memory of 1552	2616	Unicorn-40955.exe	39
PID 2616 wrote to memory of 1552	2616	Unicorn-40955.exe	39
PID 2552 wrote to memory of 2836	2552	Unicorn-10883.exe	40
PID 2552 wrote to memory of 2836	2552	Unicorn-10883.exe	40
PID 2552 wrote to memory of 2836	2552	Unicorn-10883.exe	40
PID 2552 wrote to memory of 2836	2552	Unicorn-10883.exe	40
PID 3068 wrote to memory of 2864	3068	Trojan.Win32.Fareit.VB.exe	41
PID 3068 wrote to memory of 2864	3068	Trojan.Win32.Fareit.VB.exe	41
PID 3068 wrote to memory of 2864	3068	Trojan.Win32.Fareit.VB.exe	41
PID 3068 wrote to memory of 2864	3068	Trojan.Win32.Fareit.VB.exe	41
PID 2968 wrote to memory of 2576	2968	Unicorn-47085.exe	42
PID 2968 wrote to memory of 2576	2968	Unicorn-47085.exe	42
PID 2968 wrote to memory of 2576	2968	Unicorn-47085.exe	42
PID 2968 wrote to memory of 2576	2968	Unicorn-47085.exe	42
PID 2696 wrote to memory of 2256	2696	Unicorn-15622.exe	43
PID 2696 wrote to memory of 2256	2696	Unicorn-15622.exe	43
PID 2696 wrote to memory of 2256	2696	Unicorn-15622.exe	43
PID 2696 wrote to memory of 2256	2696	Unicorn-15622.exe	43
PID 2780 wrote to memory of 984	2780	Unicorn-29061.exe	44
PID 2780 wrote to memory of 984	2780	Unicorn-29061.exe	44
PID 2780 wrote to memory of 984	2780	Unicorn-29061.exe	44
PID 2780 wrote to memory of 984	2780	Unicorn-29061.exe	44
PID 2360 wrote to memory of 2172	2360	Unicorn-11693.exe	45
PID 2360 wrote to memory of 2172	2360	Unicorn-11693.exe	45
PID 2360 wrote to memory of 2172	2360	Unicorn-11693.exe	45
PID 2360 wrote to memory of 2172	2360	Unicorn-11693.exe	45

C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Fareit.VB.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Fareit.VB.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11693.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58943.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        9⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        9⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        9⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        9⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
        9⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        8⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        8⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        8⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        8⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        8⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32189.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2807.exe
        8⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe
        7⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4788.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60295.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39347.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60614.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52631.exe
        8⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        8⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56388.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        8⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41125.exe
        7⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        7⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        6⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        7⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
        6⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
        8⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        8⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60295.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        7⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18725.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54693.exe
        6⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2055.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        7⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        7⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36692.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        7⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23523.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        7⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3704.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        6⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        5⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3436.exe
        5⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58759.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49523.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
        5⤵
        
        PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50853.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe
        7⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        8⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
        8⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        7⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        7⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        6⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        7⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29837.exe
        7⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        6⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41177.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5990.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe
        6⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47509.exe
        7⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21263.exe
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26708.exe
        6⤵
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33918.exe
        5⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        6⤵
        
        PID:616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
        6⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
        5⤵
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
        6⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        7⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        8⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        8⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        7⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
        7⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exe
        6⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41573.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7979.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29522.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7884.exe
        5⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
        6⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64482.exe
        5⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31557.exe
        6⤵
        
        PID:784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        6⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18777.exe
        6⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30140.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18700.exe
        5⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7787.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14367.exe
      4⤵
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        5⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62178.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12230.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
      4⤵
      PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40042.exe
      4⤵
      PID:7096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19063.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51180.exe
        7⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        8⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        8⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        7⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe
        6⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        7⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        7⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        6⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43971.exe
        7⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        6⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1442.exe
        5⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46728.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        5⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18777.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48696.exe
        5⤵
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36692.exe
        5⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62377.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40044.exe
        5⤵
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23443.exe
      4⤵
      PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
      4⤵
      PID:6764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59903.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        6⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        6⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12836.exe
        7⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        5⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        6⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
        5⤵
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        5⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5484.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
      4⤵
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
      4⤵
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
        5⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62052.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        6⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11834.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        5⤵
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe
      4⤵
      PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18725.exe
      4⤵
      PID:6636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32960.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50521.exe
      4⤵
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        5⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        5⤵
        
        PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
      4⤵
      PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
      4⤵
      PID:6772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
    3⤵
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20229.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
      4⤵
      PID:6952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
    3⤵
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19914.exe
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
    3⤵
    PID:4312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21108.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28643.exe
    3⤵
    PID:6608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
        7⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        8⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        8⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
        8⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61979.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        7⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        7⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63264.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60002.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65112.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        6⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        5⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59419.exe
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39500.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        6⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1442.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6821.exe
        6⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11626.exe
        5⤵
        
        PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26708.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        5⤵
        
        PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
        5⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        6⤵
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9029.exe
        5⤵
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62708.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
      4⤵
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45925.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        5⤵
        
        PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
      4⤵
      PID:904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22243.exe
      4⤵
      PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
      4⤵
      PID:6500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32540.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4198.exe
        7⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64359.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        7⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exe
        6⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18725.exe
        6⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
        5⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43088.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12884.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
        5⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        5⤵
        
        PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
      4⤵
      PID:292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34090.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exe
        5⤵
        
        PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
      4⤵
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
      4⤵
      PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12247.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        5⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38867.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2755.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
      4⤵
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46848.exe
        5⤵
        
        PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
      4⤵
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18958.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
      4⤵
      PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50369.exe
      4⤵
      PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61979.exe
      4⤵
      PID:6808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
    3⤵
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
    3⤵
    PID:5928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
    3⤵
    PID:7100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40955.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40955.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40900.exe
        6⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65105.exe
        7⤵
        
        PID:284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15777.exe
        7⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        5⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53757.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33018.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7180.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        5⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31070.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5707.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        5⤵
        
        PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
      4⤵
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27162.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64212.exe
        5⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        5⤵
        
        PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1442.exe
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4819.exe
      4⤵
      PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        5⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11375.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        6⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        6⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        5⤵
        
        PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62387.exe
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
      4⤵
      PID:7112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
      4⤵
      PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        5⤵
        
        PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
    3⤵
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
      4⤵
      PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35252.exe
    3⤵
    PID:3208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
    3⤵
    PID:4788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
    3⤵
    PID:5796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
    3⤵
    PID:6992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10396.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40625.exe
        5⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        6⤵
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        6⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8685.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        5⤵
        
        PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30847.exe
      4⤵
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48696.exe
      4⤵
      PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
      4⤵
      PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11094.exe
      4⤵
      PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21366.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40625.exe
      4⤵
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        5⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
      4⤵
      PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
      4⤵
      PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9222.exe
    3⤵
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27162.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14829.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
      4⤵
      PID:7956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
    3⤵
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
    3⤵
    PID:6732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exe
      4⤵
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
      4⤵
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
      4⤵
      PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
      4⤵
      PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
    3⤵
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21026.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
    3⤵
    PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exe
    3⤵
    PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35125.exe
      4⤵
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
      4⤵
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5437.exe
    3⤵
    PID:3672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
    3⤵
    PID:4284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
    3⤵
    PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
    3⤵
    PID:6936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32692.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32692.exe
  2⤵
  PID:264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
    3⤵
    PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14829.exe
    3⤵
    PID:5572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
    3⤵
    PID:7972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17962.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17962.exe
  2⤵
  PID:268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
  2⤵
  PID:916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
  2⤵
  PID:4328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
  2⤵
  PID:6012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59643.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59643.exe
  2⤵
  PID:6340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe

Filesize
468KB

MD5
dbda8d92668b5a9121f8dd8fa716799c

SHA1
abfbb626d376add2545b91cbba703e14cc3e07a8

SHA256
65e8cf8374ffcc3f070264744cc95c350a1858d1f1cdb9d43bd474403a04beb0

SHA512
25c9e7b22cb7c9676d5cb6ee4af9b46da221eb8d8490a1a2d2ac88e2602a224b919cb194be67f17bc6aef05e4bf4a2775563da77739dfcca8939e97403aa5331

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe

Filesize
468KB

MD5
b00804e0b9039c20defa96e82a63035d

SHA1
c8daf7e29f1a88061bf3be993e44a177ee708306

SHA256
f8e2625932ac1b6b3deb6f8d0452ac2e6816b241fe0934ea31c676884c682a4b

SHA512
34dd78f8b48aa5a6254c80a104219ccc99aad277f0d4ab34a641b6e47c1833eb347d900d27de34fdd729ef516c0d8f4606ecb4df5818ae10c095b1a9c2ed8963

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe

Filesize
468KB

MD5
43ff79f5c8b0e5a6877ea3028711c72d

SHA1
6ca84ecb9858a50d6f1abe1cb4442540a4b829f6

SHA256
31f6d0fc4b9fd4433e07222f5f2fab008e797478994df5621bb62325dea774db

SHA512
0f17474b0c364f4c62b40f5324b9f9abc33901cf63572c094f7166d98a94078670ec21880fb5b41d73c2b4abdbc17dd048aae85bc8becc418a6041c62b9c9e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe

Filesize
468KB

MD5
703ae0f1dd455367b8a64cc60d7bc105

SHA1
40f5520b325e23e30745e0d7fa5e3a85b8b84e51

SHA256
2b06c788ec51476ec6a3c03ce6d418ae3376cae57fb74ab86920933683110bf9

SHA512
dc19d7810b488bd38c8e92c66407366f67a3e46678459bc95e6c1972c02a8f12d75c18dc52ed39598880798838e88f969eb1a255c1988a51fdb02a989a767b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe

Filesize
468KB

MD5
fbd280babde5114d42ff1588ed776ebd

SHA1
b85d5956c9d8eda47637d8091b5ebcd95d8749c8

SHA256
b450a6ad5853b82aefafbe62e2a0238110ce9fde96d18dd54d4cdd90da655908

SHA512
c6f04f9f6776fd10649e2c8aa0cc50077c3c765eee3088205ae1ec53d754de9ba28394a3b4fa018212b013ee08fed35580264ca9ad105e76c573981b4b58f149

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe

Filesize
468KB

MD5
a3600479cd026859d2eaa8d85ce068e2

SHA1
ebd8c9e7bf99836e3305d70b6ae7ff84241a4994

SHA256
bd5e9ae6c6933bd73eac764398a7fa3d700e32fc6584be6ceb3e5def9f996b3d

SHA512
005ec16d8a9cc849ca7d01b1cb8474ecffb523dc026b978d2ed9cd78a59ad844072b3297f578aa60be67ab18aab92b43de29f4134937dba90301430e7f5f6f3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe

Filesize
468KB

MD5
4b56ba842d531d19e476681e76fafd62

SHA1
a398dee87cbadbcda7bfadc1b215cb7daf2682c7

SHA256
dcd8b0bc59a77b7e1d62ccbba5803fb724af4b382797076fc15fd43fc9071179

SHA512
0171da6f89f78b802f0bd608be81ab6becc4eeacceaae4c1ffd97d669195777627de77c77faf699cb9747276aec337e5e90c7fba40bd43c0e68c63889fff38be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe

Filesize
468KB

MD5
a705599f13530c72602ff372cb4a7f55

SHA1
116f55a8427c014d04d8bcf8052f77861d632bf5

SHA256
764347b38214029ff7613232a403f5880778bcbd69e988824ad2ea86d806fa86

SHA512
7bea26a19342b1aade9f411384eb05e9500072287185573d25f8acb940dd30a1ad94cadef291af75a6ec838e75480286634e4db5a30f60b862977040d234d959

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe

Filesize
468KB

MD5
46c28851e5c5f7c69c8e048c3fb857f1

SHA1
967e0e5998820a80ebf5c2143e54bd7b2d4c80ea

SHA256
8cbd2016dac0a17e1ec2efaed88a79273c81a9b74a27f9b37ac6ab78a6ce8c3f

SHA512
c68456ac42e665ed3fc7a9328035a9ca3f9bc23bbb02ffc393cf70fb50d933dff4c85325dce335a6935ebf6f9c58ea52dfa1b3c5603bdab78062570f2358679c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe

Filesize
468KB

MD5
ac24be25a2cd11df1039009fe6c5e899

SHA1
37b2dd76e98ce878491bf761adf576e9925a2044

SHA256
015e42c66dff1695b1fe416e19f27851953faa55164cf30683d87a1c47eb6610

SHA512
5dcd1e72143ff8700bb70a37b04fcc33dacfc6e616b880ad77f95a0ae781d4175614a781aa1a38ca0da2600feb75b168ee80af5f6aeaf4d29923d605606a3913

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe

Filesize
468KB

MD5
7cf784d77ee0e4755405ac388cb6d291

SHA1
85bce341a20f119e8a8b4d07af7c49e2854dd86a

SHA256
0da3166407bd661e2ae499f7810185e52ac7c4ec6482466af06bcbd89a591ecd

SHA512
81dd255d3827d7d7a462fcc2691b2c2e4d165b1be7dd40d74865f7d4669b6efe6b60bf3d30365fd53804170a7fd4c566c36bf0a257b4f09e4f44a0a6a91956bc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11693.exe

Filesize
468KB

MD5
bd03ca123948135e5c0427e807d64712

SHA1
fb7cebfd82163ec6454faecde92114483f1f30cb

SHA256
1de5eb710aa64d808e0462b5854cd8426b8d62501b3cc4b5b0b30328c735bbb3

SHA512
b95c28b1b8c156a4b3243722d76b65fb972117ba0004bca85317a23184272dc0e65496cdaf531d720b4d6d3c7a64cd5fe8067c88c721a72db8f00f3d82738cc2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe

Filesize
468KB

MD5
b9ac21cd175bf076439d0a606a55b523

SHA1
899f915ecbab12ce0ed9fb751bbed3388b42e578

SHA256
52aa48e89c23b4a977407ccc201c9290477c3625036be932dbb246ae44fe7885

SHA512
d89932c69d405ef861c081ba9e7be7bf16fce296d17aed855717f394f0c8b56736f6e21e71cae2cf097acca1b5ea3448356ee6983cb45c3dbb44be378e7a1bbf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe

Filesize
468KB

MD5
11e1854e1c97411b1d381e1007a043e6

SHA1
f53eee478ff5e39d42460d2ef70cf065b496458a

SHA256
1ee8cdabdecdc89a6ed607a0218c940be3567f1f8474dc234d18975337ab1932

SHA512
0d53009e36abb8f69fbce044d9c0f238e11dee605dd504c804aea6067d22446a7ca522294adf698a8c1e3418fdc883bd5fd57620a5b2dff073dc55b40a007f10

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe

Filesize
468KB

MD5
e0c42f5a17cc0ef9104dab0041dd4523

SHA1
282591d6d56d267ce55ccfa02a23832cbc2af959

SHA256
433bff0f7139c1c63aef431dced77f6fe6431810a9e66350af37c9ac8df132f5

SHA512
225de9cacec09bdc5768cd56ee792d1ad9ca1aec52ee4e2e526eb3db90040ae99e94067ba9241bc072706543c9013bdd00b4d5a1b0ce17ff1dd1d9273b753902

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe

Filesize
468KB

MD5
31cb572d6ed2994c388761a3df6285d7

SHA1
d59842bd354ab58e2ffec60b416578f7b2fad1a7

SHA256
104486e72127b3a20bfd71eec41fe85aa7c3998c50682c0d133d5f95893d1cb2

SHA512
e7686854af2b31d129341f4cb496042d401ab0b64c7ff21c1e8d40b51c2f6f9a07b4487d3fe31fe4214e91ddd110f0f658a237661c01355ff63c4c5048ced8cb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40955.exe

Filesize
468KB

MD5
f3eed6021e5927b34c112fd250475f01

SHA1
4eb10e9f73ebef6d844f7224be4f892b7a310a1e

SHA256
458f1d9b6b4026b96bdcf4e354709dfc808ef875a8cac5ed764e2514f42514bd

SHA512
b05477a97ef554b68a8d2e41a78100e0bb6ebd39e8c5ee78a31ace26ccbde898d8e9e2e7fc8d6270be53e572ce408d000fc84e8507c3d09bb195ecf865aa7662

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe

Filesize
468KB

MD5
ea4707520778be95d8e9816e3792bf6f

SHA1
9d1dc926bf730aaa29ec9dc8868015495e60d02e

SHA256
635dc3e02de56e9ff91f9d7b51f33d5fcc0190776cc92d65f93a905eabdd43a8

SHA512
55f68ebdae910a6d004b4da011d84e1ff4fec8abcca0b94889261f0dc8bbd660e8ba9b0edcde34c890a64d096d980f09a5426131a91cb7be4556a0686bf3f518

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe

Filesize
468KB

MD5
a64e41018b6c6d2b46839ba2094a31ee

SHA1
421568c09262e9a7359d67185017d91b633f28e5

SHA256
875a2f54430764fd223362e2d7129f5fe9134b37e4963a05291047658a533ea5

SHA512
6689d0ddbb39029141c572fe963456083035ad2b8238bb91d0f2140ac585a2441e699acbfc81e006f82aeed3f0b1bd89e317aa5680df6ffae3e5094f47b54ea8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe

Filesize
468KB

MD5
99335bc5c0e49b4a0c8f98c86aa21288

SHA1
5cc171149b2fbe58453bf0c6f57a99383d431399

SHA256
edcd1a8bb54ba0f945bbd3e0cbe9233942a9883cbf7e3ff573dabcc6a21f30bc

SHA512
d1a701248a7dfde49bdc12f6cc969a782ea47bdb089ab2322313ea6034f3ccd58f61fb7094488a2a2dea2d1a8b6f6369e26a91fe0db732b711e3df3e5b8e919a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58943.exe

Filesize
468KB

MD5
9db11141ef41680f992a609e62e79099

SHA1
5a90d81b295293714e5cbbb8392a822b32049d83

SHA256
0d350517b00ffa6b2cb3238927507275b4626e2f7e9f1b4c514ba974d1a4ade6

SHA512
c29aa2345b6023f6635929755b91384cc7aab2fe643102fed612f2c36cac69d0bc3a2dae60fe25cf9d10e3bd28b580a947272077aba2326b06555e08c3742e08

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe

Filesize
468KB

MD5
c370d5c1ea0b5ac8b5c62dfe0d0156e9

SHA1
a9cfbd139831495519abd669a93e87ae1b3daff2

SHA256
9eef16d11bd947f8170a452fcc8125c08305030ab3afe9231decb1df89798cb9

SHA512
a2bb85393084e404b61104497af6c6305130d9d77b179f4169dd7de56be44be4d05b68d2adf1db80b1d7d55caca23508cda4bd1f88f59a1e698764222d7ac2aa

Download Submit