d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
Size

468KB
MD5

16cec762b9d980c3f97487cafaaadda8
SHA1

a53423b9f12fecbfdd18464a1bbc5572e71909cf
SHA256

d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699
SHA512

45197774191da34bb36ef10eba03fa742ea159b0a93086bfa7cc16f94c903adb348f258e073a32dd7084793e30afe9fe1cf9de6a1bc7cdc7673e197f6742c74c
SSDEEP

3072:1buhogIdI05UtbYJ2zcjcfu/uChyPIpdnLH0iVHTYafLcsvubseL:1boow8UtO24jcfj0KaYaj9vub

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2200	Unicorn-32241.exe
2724	Unicorn-30408.exe
2656	Unicorn-16533.exe
2696	Unicorn-3118.exe
2536	Unicorn-32540.exe
2316	Unicorn-18613.exe
2224	Unicorn-54815.exe
2848	Unicorn-56019.exe
2084	Unicorn-36646.exe
624	Unicorn-23456.exe
2344	Unicorn-17133.exe
2416	Unicorn-39600.exe
2040	Unicorn-23264.exe
1824	Unicorn-18167.exe
1576	Unicorn-64104.exe
2296	Unicorn-1380.exe
2060	Unicorn-25370.exe
2172	Unicorn-33669.exe
2360	Unicorn-10818.exe
1076	Unicorn-33285.exe
2496	Unicorn-49081.exe
892	Unicorn-55106.exe
920	Unicorn-45984.exe
1832	Unicorn-54914.exe
2240	Unicorn-54914.exe
1592	Unicorn-18328.exe
1924	Unicorn-18651.exe
1648	Unicorn-18385.exe
1672	Unicorn-14929.exe
2052	Unicorn-34795.exe
2488	Unicorn-44809.exe
2132	Unicorn-16303.exe
1912	Unicorn-52182.exe
1512	Unicorn-38991.exe
1572	Unicorn-55135.exe
1724	Unicorn-25213.exe
2788	Unicorn-5228.exe
2740	Unicorn-18771.exe
2792	Unicorn-24902.exe
3020	Unicorn-21180.exe
2600	Unicorn-57382.exe
2996	Unicorn-4931.exe
2808	Unicorn-10677.exe
1404	Unicorn-56157.exe
2716	Unicorn-61798.exe
1836	Unicorn-54023.exe
584	Unicorn-40287.exe
2028	Unicorn-60153.exe
1856	Unicorn-56462.exe
1928	Unicorn-62592.exe
108	Unicorn-25679.exe
2032	Unicorn-45545.exe
2932	Unicorn-45545.exe
2328	Unicorn-45545.exe
2700	Unicorn-22710.exe
1548	Unicorn-22525.exe
1948	Unicorn-31191.exe
3040	Unicorn-31456.exe
2440	Unicorn-17257.exe
2208	Unicorn-4834.exe
860	Unicorn-23536.exe
1264	Unicorn-43210.exe
800	Unicorn-38227.exe
1676	Unicorn-51963.exe

Loads dropped DLL 64 IoCs

pid	Process
2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
2200	Unicorn-32241.exe
2200	Unicorn-32241.exe
2724	Unicorn-30408.exe
2724	Unicorn-30408.exe
2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
2200	Unicorn-32241.exe
2200	Unicorn-32241.exe
2656	Unicorn-16533.exe
2656	Unicorn-16533.exe
2696	Unicorn-3118.exe
2696	Unicorn-3118.exe
2724	Unicorn-30408.exe
2724	Unicorn-30408.exe
2316	Unicorn-18613.exe
2316	Unicorn-18613.exe
2536	Unicorn-32540.exe
2200	Unicorn-32241.exe
2536	Unicorn-32540.exe
2200	Unicorn-32241.exe
2224	Unicorn-54815.exe
2224	Unicorn-54815.exe
2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
2656	Unicorn-16533.exe
2656	Unicorn-16533.exe
2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
2848	Unicorn-56019.exe
2848	Unicorn-56019.exe
2696	Unicorn-3118.exe
2696	Unicorn-3118.exe
2084	Unicorn-36646.exe
2084	Unicorn-36646.exe
2724	Unicorn-30408.exe
624	Unicorn-23456.exe
2724	Unicorn-30408.exe
624	Unicorn-23456.exe
2316	Unicorn-18613.exe
2316	Unicorn-18613.exe
1824	Unicorn-18167.exe
1824	Unicorn-18167.exe
2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
2040	Unicorn-23264.exe
2344	Unicorn-17133.exe
2040	Unicorn-23264.exe
2344	Unicorn-17133.exe
2536	Unicorn-32540.exe
2536	Unicorn-32540.exe
2200	Unicorn-32241.exe
2416	Unicorn-39600.exe
2200	Unicorn-32241.exe
2416	Unicorn-39600.exe
1576	Unicorn-64104.exe
2224	Unicorn-54815.exe
1576	Unicorn-64104.exe
2224	Unicorn-54815.exe
2656	Unicorn-16533.exe
2656	Unicorn-16533.exe
2296	Unicorn-1380.exe
2296	Unicorn-1380.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7888	7336	WerFault.exe	742

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23859.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
2200	Unicorn-32241.exe
2724	Unicorn-30408.exe
2656	Unicorn-16533.exe
2696	Unicorn-3118.exe
2316	Unicorn-18613.exe
2536	Unicorn-32540.exe
2224	Unicorn-54815.exe
2848	Unicorn-56019.exe
2084	Unicorn-36646.exe
624	Unicorn-23456.exe
2040	Unicorn-23264.exe
2416	Unicorn-39600.exe
2344	Unicorn-17133.exe
1824	Unicorn-18167.exe
1576	Unicorn-64104.exe
2296	Unicorn-1380.exe
2060	Unicorn-25370.exe
2360	Unicorn-10818.exe
2172	Unicorn-33669.exe
1076	Unicorn-33285.exe
2496	Unicorn-49081.exe
892	Unicorn-55106.exe
1832	Unicorn-54914.exe
920	Unicorn-45984.exe
1924	Unicorn-18651.exe
1592	Unicorn-18328.exe
2240	Unicorn-54914.exe
1648	Unicorn-18385.exe
1672	Unicorn-14929.exe
2052	Unicorn-34795.exe
2488	Unicorn-44809.exe
2132	Unicorn-16303.exe
1912	Unicorn-52182.exe
1512	Unicorn-38991.exe
1572	Unicorn-55135.exe
2740	Unicorn-18771.exe
2788	Unicorn-5228.exe
1724	Unicorn-25213.exe
2792	Unicorn-24902.exe
3020	Unicorn-21180.exe
2600	Unicorn-57382.exe
2996	Unicorn-4931.exe
2808	Unicorn-10677.exe
1404	Unicorn-56157.exe
2716	Unicorn-61798.exe
1836	Unicorn-54023.exe
2028	Unicorn-60153.exe
584	Unicorn-40287.exe
1928	Unicorn-62592.exe
1856	Unicorn-56462.exe
2932	Unicorn-45545.exe
2032	Unicorn-45545.exe
2328	Unicorn-45545.exe
108	Unicorn-25679.exe
2700	Unicorn-22710.exe
1948	Unicorn-31191.exe
1548	Unicorn-22525.exe
3040	Unicorn-31456.exe
2440	Unicorn-17257.exe
2208	Unicorn-4834.exe
860	Unicorn-23536.exe
1264	Unicorn-43210.exe
1676	Unicorn-51963.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2200	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	31
PID 2064 wrote to memory of 2200	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	31
PID 2064 wrote to memory of 2200	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	31
PID 2064 wrote to memory of 2200	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	31
PID 2064 wrote to memory of 2724	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	32
PID 2064 wrote to memory of 2724	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	32
PID 2064 wrote to memory of 2724	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	32
PID 2064 wrote to memory of 2724	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	32
PID 2200 wrote to memory of 2656	2200	Unicorn-32241.exe	33
PID 2200 wrote to memory of 2656	2200	Unicorn-32241.exe	33
PID 2200 wrote to memory of 2656	2200	Unicorn-32241.exe	33
PID 2200 wrote to memory of 2656	2200	Unicorn-32241.exe	33
PID 2724 wrote to memory of 2696	2724	Unicorn-30408.exe	34
PID 2724 wrote to memory of 2696	2724	Unicorn-30408.exe	34
PID 2724 wrote to memory of 2696	2724	Unicorn-30408.exe	34
PID 2724 wrote to memory of 2696	2724	Unicorn-30408.exe	34
PID 2064 wrote to memory of 2536	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	35
PID 2064 wrote to memory of 2536	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	35
PID 2064 wrote to memory of 2536	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	35
PID 2064 wrote to memory of 2536	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	35
PID 2200 wrote to memory of 2316	2200	Unicorn-32241.exe	36
PID 2200 wrote to memory of 2316	2200	Unicorn-32241.exe	36
PID 2200 wrote to memory of 2316	2200	Unicorn-32241.exe	36
PID 2200 wrote to memory of 2316	2200	Unicorn-32241.exe	36
PID 2656 wrote to memory of 2224	2656	Unicorn-16533.exe	37
PID 2656 wrote to memory of 2224	2656	Unicorn-16533.exe	37
PID 2656 wrote to memory of 2224	2656	Unicorn-16533.exe	37
PID 2656 wrote to memory of 2224	2656	Unicorn-16533.exe	37
PID 2696 wrote to memory of 2848	2696	Unicorn-3118.exe	38
PID 2696 wrote to memory of 2848	2696	Unicorn-3118.exe	38
PID 2696 wrote to memory of 2848	2696	Unicorn-3118.exe	38
PID 2696 wrote to memory of 2848	2696	Unicorn-3118.exe	38
PID 2724 wrote to memory of 2084	2724	Unicorn-30408.exe	39
PID 2724 wrote to memory of 2084	2724	Unicorn-30408.exe	39
PID 2724 wrote to memory of 2084	2724	Unicorn-30408.exe	39
PID 2724 wrote to memory of 2084	2724	Unicorn-30408.exe	39
PID 2316 wrote to memory of 624	2316	Unicorn-18613.exe	40
PID 2316 wrote to memory of 624	2316	Unicorn-18613.exe	40
PID 2316 wrote to memory of 624	2316	Unicorn-18613.exe	40
PID 2316 wrote to memory of 624	2316	Unicorn-18613.exe	40
PID 2200 wrote to memory of 2344	2200	Unicorn-32241.exe	42
PID 2200 wrote to memory of 2344	2200	Unicorn-32241.exe	42
PID 2200 wrote to memory of 2344	2200	Unicorn-32241.exe	42
PID 2200 wrote to memory of 2344	2200	Unicorn-32241.exe	42
PID 2224 wrote to memory of 2416	2224	Unicorn-54815.exe	43
PID 2224 wrote to memory of 2416	2224	Unicorn-54815.exe	43
PID 2224 wrote to memory of 2416	2224	Unicorn-54815.exe	43
PID 2224 wrote to memory of 2416	2224	Unicorn-54815.exe	43
PID 2536 wrote to memory of 2040	2536	Unicorn-32540.exe	41
PID 2536 wrote to memory of 2040	2536	Unicorn-32540.exe	41
PID 2536 wrote to memory of 2040	2536	Unicorn-32540.exe	41
PID 2536 wrote to memory of 2040	2536	Unicorn-32540.exe	41
PID 2656 wrote to memory of 1576	2656	Unicorn-16533.exe	45
PID 2656 wrote to memory of 1576	2656	Unicorn-16533.exe	45
PID 2656 wrote to memory of 1576	2656	Unicorn-16533.exe	45
PID 2656 wrote to memory of 1576	2656	Unicorn-16533.exe	45
PID 2064 wrote to memory of 1824	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	44
PID 2064 wrote to memory of 1824	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	44
PID 2064 wrote to memory of 1824	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	44
PID 2064 wrote to memory of 1824	2064	d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe	44
PID 2848 wrote to memory of 2296	2848	Unicorn-56019.exe	46
PID 2848 wrote to memory of 2296	2848	Unicorn-56019.exe	46
PID 2848 wrote to memory of 2296	2848	Unicorn-56019.exe	46
PID 2848 wrote to memory of 2296	2848	Unicorn-56019.exe	46

C:\Users\Admin\AppData\Local\Temp\d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe
"C:\Users\Admin\AppData\Local\Temp\d7af7438f80538602cdaf635f914eeb44193bf8f9df9a38cec43b310e6d53699.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16533.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54815.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61798.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
        8⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        8⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32422.exe
        8⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8279.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        7⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
        7⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
        8⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        8⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41187.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        8⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10390.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32813.exe
        7⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        6⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14929.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        7⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        8⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
        8⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34205.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        7⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        7⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7715.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
        6⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56462.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
        6⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
        6⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43060.exe
        5⤵
        
        PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61181.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1143.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        5⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        5⤵
        
        PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34795.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        8⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        8⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        8⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46919.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50542.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        7⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6499.exe
        6⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23915.exe
        7⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
        7⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1143.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        6⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30084.exe
        5⤵
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18383.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18225.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        6⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58714.exe
        6⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
        6⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17552.exe
        6⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        5⤵
        
        PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1143.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54829.exe
        5⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
        5⤵
        
        PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        6⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        6⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        6⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        6⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        5⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33588.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        6⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        6⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38018.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        5⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        5⤵
        
        PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        5⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40419.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6743.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17519.exe
        7⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31252.exe
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        6⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        5⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        5⤵
        
        PID:604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        5⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        5⤵
        
        PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
      4⤵
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43754.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        5⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
      4⤵
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61980.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
      4⤵
      PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23456.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        7⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        8⤵
        
        PID:660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        8⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        8⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        7⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        7⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        6⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        8⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
        8⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64660.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6442.exe
        7⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
        7⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        6⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33699.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21180.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        6⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
        7⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
        6⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        6⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23073.exe
        5⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        6⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29854.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        6⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10260.exe
        5⤵
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
        5⤵
        
        PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57382.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18836.exe
        6⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        7⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        8⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        8⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        8⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55502.exe
        7⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59393.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
        6⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        6⤵
        
        PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        5⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        6⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
        6⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55502.exe
        6⤵
        
        PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
        5⤵
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33311.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        5⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        5⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        6⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
        5⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22822.exe
        5⤵
        
        PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
      4⤵
      PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        5⤵
        
        PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        5⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        5⤵
        
        PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58762.exe
      4⤵
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34230.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34654.exe
      4⤵
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
      4⤵
      PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22432.exe
      4⤵
      PID:7192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        5⤵
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        6⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        6⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
        5⤵
        
        PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-254.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1342.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        5⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        5⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        5⤵
        
        PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25679.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        5⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exe
      4⤵
      PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
      4⤵
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57281.exe
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53079.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58301.exe
        5⤵
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59747.exe
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        5⤵
        
        PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36712.exe
      4⤵
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41123.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55886.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22015.exe
      4⤵
      PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
      4⤵
      PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
      4⤵
      PID:7756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22525.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
      4⤵
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        5⤵
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        5⤵
        
        PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
      4⤵
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
      4⤵
      PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23852.exe
      4⤵
      PID:8036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
      4⤵
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        5⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
        5⤵
        
        PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
      4⤵
      PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
      4⤵
      PID:7548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
    3⤵
    PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
    3⤵
    PID:6248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
    3⤵
    PID:7404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30408.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30408.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1380.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13537.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31765.exe
        9⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        9⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        9⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        9⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
        9⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        8⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
        8⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
        8⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42104.exe
        7⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        8⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        8⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe
        8⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        8⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
        8⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
        7⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33699.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39119.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62110.exe
        7⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
        7⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23536.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        7⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11145.exe
        8⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        8⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
        8⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        8⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6656.exe
        7⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        7⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60666.exe
        6⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59332.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        7⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20146.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6780.exe
        6⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        6⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43210.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        7⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        6⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        6⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        6⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51963.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        6⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        5⤵
        
        PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        5⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
        5⤵
        
        PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25370.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
        6⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        7⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8395.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        7⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44539.exe
        6⤵
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6935.exe
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        6⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63054.exe
        5⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31765.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        6⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        6⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
        5⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42493.exe
        5⤵
        
        PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        5⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18225.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        6⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        6⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        5⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        5⤵
        
        PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
      4⤵
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        5⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        5⤵
        
        PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26473.exe
      4⤵
      PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
      4⤵
      PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
      4⤵
      PID:7216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36646.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33669.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
        5⤵
        Executes dropped EXE
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        6⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57561.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
        6⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        5⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        5⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7516.exe
        5⤵
        
        PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        5⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        6⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
        6⤵
        
        PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        5⤵
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        5⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        5⤵
        
        PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
      4⤵
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        6⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47780.exe
        6⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23130.exe
        6⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50022.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10007.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        5⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61945.exe
        5⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49418.exe
        5⤵
        
        PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
      4⤵
      PID:480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41553.exe
        5⤵
        
        PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        5⤵
        
        PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20453.exe
      4⤵
      PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24254.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1778.exe
      4⤵
      PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62524.exe
      4⤵
      PID:8132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26298.exe
        5⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        6⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        6⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
        5⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39888.exe
        5⤵
        
        PID:7636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
      4⤵
      PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15809.exe
        5⤵
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        5⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
      4⤵
      PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
      4⤵
      PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
      4⤵
      PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
      4⤵
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5710.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21833.exe
        5⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57744.exe
        5⤵
        
        PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52653.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
      4⤵
      PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
      4⤵
      PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
    3⤵
    PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
      4⤵
      PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
      4⤵
      PID:7616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
    3⤵
    PID:5764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61788.exe
    3⤵
    PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
    3⤵
    PID:7780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32540.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32540.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62726.exe
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9050.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        8⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        7⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14770.exe
        6⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55655.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
        6⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        5⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51112.exe
        6⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26535.exe
        6⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        6⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10119.exe
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        6⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe
        5⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        5⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9384.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26350.exe
        5⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32780.exe
        6⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6743.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27587.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23504.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        6⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58301.exe
        5⤵
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10355.exe
        6⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6117.exe
        6⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 148
        7⤵
        Program crash
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
        5⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
        5⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39312.exe
        5⤵
        
        PID:7760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3115.exe
      4⤵
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        5⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        5⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
        5⤵
        
        PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51366.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6792.exe
      4⤵
      PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
      4⤵
      PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34485.exe
      4⤵
      PID:7772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
      4⤵
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
        5⤵
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        5⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        5⤵
        
        PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe
      4⤵
      PID:444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49455.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
      4⤵
      PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7516.exe
      4⤵
      PID:7940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54023.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
      4⤵
      PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
      4⤵
      PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
      4⤵
      PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
      4⤵
      PID:8012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
    3⤵
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36863.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54978.exe
      4⤵
      PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
      4⤵
      PID:7752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61181.exe
    3⤵
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1143.exe
    3⤵
    PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
    3⤵
    PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
    3⤵
    PID:7952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55106.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10677.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29204.exe
        5⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        6⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14915.exe
        6⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        6⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        5⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        5⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        5⤵
        
        PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
      4⤵
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51304.exe
        5⤵
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        5⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe
        5⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        5⤵
        
        PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-254.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
      4⤵
      PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
      4⤵
      PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56032.exe
      4⤵
      PID:7604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
      4⤵
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52653.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42365.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55655.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
        5⤵
        
        PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
      4⤵
      PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
      4⤵
      PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
      4⤵
      PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
      4⤵
      PID:6600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
    3⤵
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20272.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12379.exe
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
      4⤵
      PID:8184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-982.exe
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30037.exe
    3⤵
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
    3⤵
    PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40579.exe
    3⤵
    PID:7092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
    3⤵
    PID:8120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45984.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45984.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
      4⤵
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
        5⤵
        
        PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33109.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22790.exe
      4⤵
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45098.exe
      4⤵
      PID:7260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17553.exe
    3⤵
    PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12886.exe
      4⤵
      PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23213.exe
      4⤵
      PID:7484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
    3⤵
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
    3⤵
    PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
    3⤵
    PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23852.exe
    3⤵
    PID:8112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
    3⤵
    PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
      4⤵
      PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
      4⤵
      PID:7588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16965.exe
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
    3⤵
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
    3⤵
    PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
    3⤵
    PID:8140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
  2⤵
  PID:336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
    3⤵
    PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
    3⤵
    PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
    3⤵
    PID:6228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
    3⤵
    PID:7500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exe
  2⤵
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
  2⤵
  PID:4256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28215.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28215.exe
  2⤵
  PID:5740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
  2⤵
  PID:7984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-16533.exe

Filesize
468KB

MD5
4e714ee3c68dd9bf1f0a177d6d02d957

SHA1
56bcb58503ced796df08c640ee3a883022e508d2

SHA256
8e8feff40238ca0f988eaafb1ebc07d943d2eae8a5569eb6ad3ffacc1301e476

SHA512
b937c131c3f23b8322c63725e8602aa6b6750367e457b76120f1cb4f1b1c6971520b5767682475a506a67d10f192299d48936b4140fa2bac108806b25ffd7944

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe

Filesize
468KB

MD5
ea6efeeef99913333a6448534c8ac0e7

SHA1
875d09be34893c098ab2473dbe87802d4326e102

SHA256
0208e308f21d965e70ae1b9d54149dbc0528efc0371c0b38b0d5419bfed885aa

SHA512
3d8a038c9078ec2bac5f4c8cd3f2e9b7933e38d68644ebe081ef94d4f640f87249e0a7910c2a8c12afa770866c8aa1e8f5fbd50c2a04022cd94ae7d0effe2473

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe

Filesize
468KB

MD5
aff459ee58778c1fb9a6e6f5b4bf875a

SHA1
f025c444cbc4881c6d11a99376c155b2b1d2ce6d

SHA256
3170d56579da8dce89d2d8e0061bdcf2d0a56ed14760f11ec37782af941bddd6

SHA512
0cfae4d4dc9af23914903a6c61b36774992728c877c3107fc1c1bc353d5f624199cead63c80a3a54dee36ce538f92cf26ece5c8662afe7706f79d62ec6736d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23504.exe

Filesize
468KB

MD5
1e5e170ca5ec75b8a08464f3ca40db39

SHA1
e0c5585da85590cd0d24c0b78f1fd6aaa8e31839

SHA256
5bdd38ddff4bbb944294e9f1449aec74a96379381d0ddb6b5bcac0fbac49be9e

SHA512
3d36169aeb61380b6827a481f5ae0ee297965f8e0853f95a06e677f377010138931a979f6b8306598cd5719ba7d04a28ca504d3a610781c40408b664c8836412

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe

Filesize
468KB

MD5
0f19d137a17a51188e828dbdb93192c5

SHA1
28f81e210f05617cf53bc3c90f0366a0f9fa5054

SHA256
fdc2b1546271bf18481dba1691124c2eb2a683afb114beca55344d46acead429

SHA512
832755a06607084085e7c9031f6cec02910db4a3fbbe95243fb60d2dc84964b97e0e91c5f9df9a09a6f6105ad16a4b034d2ad7547580ef7bda553e2743d65761

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55106.exe

Filesize
468KB

MD5
e606d756677549797a41c1b610b73fdb

SHA1
7720b1239028d9f3f6d442f529f5d734bfa3e3b8

SHA256
4ff6df81062a80af3f4fca14cb9f150b8974a0cbeb2ad6998b4c15b680efab7e

SHA512
b424c44f9b81beeef7227dc74f48b081255b8dfe13afafdd665afe3970cc224b03870f63f99eebfaf480a1e87aee8ec55f2db04858c9017e28dbbcac483431db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6117.exe

Filesize
468KB

MD5
701b44893c75291b67dbddcd6728f26b

SHA1
32b07b39c407722393e47e17d72cef2cd235098a

SHA256
bb33cfa1c9a5bd770e566bef0aa78a6624a6cd561a2de2ccba64c086f0181295

SHA512
e5e12c74fe765c716725f116ce8b0e1218357cb89244ce435730ed0a5e401ab7d11c6fd57d40bad9d555c7fccec2794e7687228e068c74d3e807f0b98a92c0ef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1380.exe

Filesize
468KB

MD5
91e40f37ba445fb54d9d95210272e774

SHA1
a5b03d3e22062ce5ed29a28d00d4c57f28bfbd72

SHA256
d4946721c6f874348b898d0d7d2e71b3a07c2c82c1cea2f9e69381e8013a8eb6

SHA512
5c22bb2651088e541fc53a1d52e38112fc114618fb9ad3792c93610f95f206866a32c92466da4f7fba42c15409e71e6fef8f39df8b1906411027072b0aae4f25

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe

Filesize
468KB

MD5
d559b0db8245dc8304bc9bbb822f42a9

SHA1
932e34edf48312d0e5bab1d80c5ebd1006411661

SHA256
d64aaf5b9021e8187f7d0c32996669049cb91c4c5dc80af7c41516df85f7b65e

SHA512
e60cc89568e8f56ee54622c842fbce6dbde4305c2ad6ae10e2bbfe91badf22c24e71f454d26dbfe7bb0236796a5de9712f0a2f4c8617970a0013856958300387

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe

Filesize
468KB

MD5
b2287de890777a3be6d8c46091c76a46

SHA1
c4aceffa514c8d5f1b8c2b72c0581746f04e3eed

SHA256
967a76140e79dd8308879ab901e5d87a27311acda58529d9825f7c6a41e48aa2

SHA512
5b211217661f15db93d2472845644ef1a09b133d4ca024d4cee734e2b229c99c7a1783720f2335da627499b823f7619af7e7fb0bbd8c76a617832516a98dfc69

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23456.exe

Filesize
468KB

MD5
176edeca15bee37238c0dea6bf042b38

SHA1
6d6c4b9b79244e7d9a46488d9cacc553870bfaab

SHA256
292520646d8dcf62ffa59797cced1998e5fb80770139cd0957f857f18b69b01e

SHA512
80e3c13bbe91fcf8891975322462c73ab50f934b0ce02d2780b9f482c0779d64626cf60b9deee55f974ed82f8a820dcce9d61066acbf76c65d684e8d68732e67

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25370.exe

Filesize
468KB

MD5
a03ec60393e71c9985a340d045e3d226

SHA1
3c6ccc500666078380bdde8129900cd1dbeab993

SHA256
53b8639b0ed803155c302544fecd3a71c6d2bc2dd9645fc95bbb55321a8c85a6

SHA512
1b3306ae8bb43360a0ab0f73c5a4d55201740f5a418477d73075b7f2bd0509f4a499f532f78f413a883a5d3576ad8727476dad222cbe329726955e185cddb38b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30408.exe

Filesize
468KB

MD5
7cae8495cf2c23d06b70ee250ff290ab

SHA1
1017c1b6a03870c118c51f6f9ddff313dfbc872e

SHA256
a55e57d4359941d20536eb4035498cdc4ff0915e9a5492534ca4c2c11d935726

SHA512
c9460eac58576e6f41dd171384432328ac682446d97be56a7209d8ea531cb476e2ffa7e1685fc9bb53085556d05aea0187a689659a98bb1e2dea7f9082842a33

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3118.exe

Filesize
468KB

MD5
486ed52b86638f28136306aac9e63f2a

SHA1
c953d380ade11927c31ae0fe13a0064e2e68b6e0

SHA256
58d7bf1f76cdc45a05dac38c9dfc2a9a976dd7b8e96bded38628a7766f18d591

SHA512
0c5add9feb4f4b86d64ce26444d6eafeea983a6bcd72691471266596857f3a0eed0c709f5f3d80a467c6a813b1aefa39cf5fa33304ea35ad64f85bb5d6c21dab

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe

Filesize
468KB

MD5
c4c55c2c99b5acbf641331399860be37

SHA1
3d12f25b1cfe8b3e398b8359b3178468facac983

SHA256
1200dda7188f439013eae4dbbb0b57ad951d52361e3def3fd8fea3ed476f480e

SHA512
946ba678228749426beae0b07ef2f84b3e8ebe18af3f5d3ede7cedfba5be7db20b979a2ff5dbd894ab0c6050207a8c138ab6fa24612dd1dbec0a228b4395b13a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32540.exe

Filesize
468KB

MD5
e070eb2896f291931abd787b4b16175f

SHA1
68aec74afb6b6f582ea1e60529581b39e99822a8

SHA256
7c373607f129080508b4ae7de1c67852a3a0551fb874aac42b64ddd94bc3c6cd

SHA512
bc1d9b1410a150fbc6ed514d6dd0c4445584fdaf1c9df07280df09cecad21d855c94e4f36587714eae28ddc57e67939c0e8b24e6bbda14deb195e88147f93afc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33669.exe

Filesize
468KB

MD5
be1387c6ae1aeb3cf78e37f1fb118829

SHA1
77d5aa7ddd7303ab49b853158e9253a3c57686d3

SHA256
f525ee32099a3105627534d0d1e07cfadbfddf0cf28d89a7c129e5fd9989d070

SHA512
9c7d3d0915da5dc86f4c29bcee4b85051b3c4e3313d79e5fa142f520bcbe8bd9f5fed39179b047c70d1b576fde50984b391ae789a139462e47e8240e56a361a0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36646.exe

Filesize
468KB

MD5
0c0906a8278e66aa973cecefd96662ce

SHA1
48ec16682b09ca0234a53e9e7126d7fb138dd7a8

SHA256
e74bdc94a260ff42de9dea000ddb2193200306ac760cb6ab6499263fbac83cec

SHA512
3b841d243aede0b943fb74f1e844b2e8d58de4a006425ba6fb13eb3150bd6205ea3b111922500dc11c203cc6cae51bdcf02c27d9cb41f6a8faf1193e63e4342c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54815.exe

Filesize
468KB

MD5
cd1edd19067794de567519a8c7860023

SHA1
787174647080abe0d708e97992bc22184a3ebcfe

SHA256
e316aba64f7b1c32ffb65819d988ee6c6c098c8dfaf800711ca849d7ced42c62

SHA512
646c125e58144b74add9c3213d37c347a971a45b8d5b7a16eeffb0c6b0c66a78576312005a3b9dba961076b29d9bad46a48c8426bb5aa6e84ca1b8b444a1bef5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe

Filesize
468KB

MD5
c97dfe9cc11e88b85e903d25992e8c27

SHA1
9be68a36ad85bae53e596a9a38f3ba06f177b39d

SHA256
2315cd38117810360370a0758fed21ab4b644cca66061601a910ebfb7c022085

SHA512
7dcfdee7422e98233b7c96b02b77b6394892033eebd8bfc74fde2449b662cda6477f159e258680b88e082e48acffec459aef8500ee059a08f0ee3ca3e9a96cc9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe

Filesize
468KB

MD5
b244a03cd86dd5613246b20d258e7dff

SHA1
66b93229e4d2814995c70b660382236daaaa8090

SHA256
8c586ca8602ded9a11c359ad4712515f2a344bbdf0aef9c68c8b780b504640df

SHA512
3ac36f3a0095b3a70c04d57c3ef85a7903143ee8165259bf8cf4fbf76a8f90dfaed27cd7850b8419c96883fb4b4e3225165b2adc9ccfc00d770e623ea8aaa9c4

Download Submit