0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
Size

468KB
MD5

96b7031db8a9ee41c6a7108c72660fa1
SHA1

6ed4e8303445c66f710775f1d05c0f10f968e8d2
SHA256

0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f
SHA512

c9ef227081799cb8faf4110221944390de9f2427679cd0ead2119199c0ba4f3c55474114c8d173d5fb9cdebbb1b3b0c3828081b951f6fea06647954e7ff52923
SSDEEP

3072:1huUogIuIw5UtGYXHzcjrf8/EoOC3lpC6FH0pVPcwaZk5C8zFbef:1hJo3gUtbH4jrfkj+owaO48zF

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2888	Unicorn-267.exe
2732	Unicorn-52566.exe
2760	Unicorn-44953.exe
2656	Unicorn-9634.exe
2672	Unicorn-6105.exe
496	Unicorn-25971.exe
872	Unicorn-32092.exe
2276	Unicorn-61933.exe
2520	Unicorn-54320.exe
3036	Unicorn-24684.exe
2940	Unicorn-51881.exe
1776	Unicorn-6209.exe
3044	Unicorn-6209.exe
3032	Unicorn-79.exe
1292	Unicorn-10028.exe
2912	Unicorn-39458.exe
1944	Unicorn-48394.exe
2804	Unicorn-28528.exe
2212	Unicorn-5315.exe
2432	Unicorn-15529.exe
624	Unicorn-34366.exe
2068	Unicorn-48778.exe
1920	Unicorn-22136.exe
948	Unicorn-56681.exe
1052	Unicorn-30304.exe
1364	Unicorn-64352.exe
1652	Unicorn-36426.exe
1664	Unicorn-42556.exe
688	Unicorn-4216.exe
1056	Unicorn-8300.exe
1632	Unicorn-50423.exe
1536	Unicorn-42809.exe
896	Unicorn-62675.exe
1552	Unicorn-21643.exe
2108	Unicorn-15512.exe
1580	Unicorn-1777.exe
2144	Unicorn-64356.exe
2880	Unicorn-64621.exe
2764	Unicorn-57008.exe
2600	Unicorn-46147.exe
2652	Unicorn-17458.exe
2928	Unicorn-40693.exe
2472	Unicorn-41247.exe
2396	Unicorn-10521.exe
2404	Unicorn-15997.exe
2668	Unicorn-1606.exe
2904	Unicorn-64627.exe
2964	Unicorn-7755.exe
2336	Unicorn-53692.exe
2996	Unicorn-1890.exe
3012	Unicorn-48091.exe
2044	Unicorn-8020.exe
2944	Unicorn-8020.exe
1108	Unicorn-8020.exe
2660	Unicorn-8020.exe
2296	Unicorn-42338.exe
1532	Unicorn-21403.exe
448	Unicorn-49437.exe
2384	Unicorn-46322.exe
672	Unicorn-33978.exe
1136	Unicorn-16826.exe
2684	Unicorn-53028.exe
2380	Unicorn-7911.exe
2360	Unicorn-298.exe

Loads dropped DLL 64 IoCs

pid	Process
2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
2888	Unicorn-267.exe
2888	Unicorn-267.exe
2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
2732	Unicorn-52566.exe
2732	Unicorn-52566.exe
2888	Unicorn-267.exe
2760	Unicorn-44953.exe
2888	Unicorn-267.exe
2760	Unicorn-44953.exe
2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
2656	Unicorn-9634.exe
2656	Unicorn-9634.exe
2732	Unicorn-52566.exe
2732	Unicorn-52566.exe
2672	Unicorn-6105.exe
2672	Unicorn-6105.exe
872	Unicorn-32092.exe
496	Unicorn-25971.exe
2760	Unicorn-44953.exe
2760	Unicorn-44953.exe
872	Unicorn-32092.exe
496	Unicorn-25971.exe
2888	Unicorn-267.exe
2888	Unicorn-267.exe
2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
2276	Unicorn-61933.exe
2276	Unicorn-61933.exe
2520	Unicorn-54320.exe
2520	Unicorn-54320.exe
2656	Unicorn-9634.exe
2656	Unicorn-9634.exe
2732	Unicorn-52566.exe
2732	Unicorn-52566.exe
3036	Unicorn-24684.exe
3036	Unicorn-24684.exe
2672	Unicorn-6105.exe
2672	Unicorn-6105.exe
3032	Unicorn-79.exe
3032	Unicorn-79.exe
1292	Unicorn-10028.exe
1292	Unicorn-10028.exe
2888	Unicorn-267.exe
2888	Unicorn-267.exe
2940	Unicorn-51881.exe
2940	Unicorn-51881.exe
2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
2760	Unicorn-44953.exe
2760	Unicorn-44953.exe
3044	Unicorn-6209.exe
3044	Unicorn-6209.exe
872	Unicorn-32092.exe
872	Unicorn-32092.exe
496	Unicorn-25971.exe
496	Unicorn-25971.exe
1944	Unicorn-48394.exe
1944	Unicorn-48394.exe
2912	Unicorn-39458.exe
2520	Unicorn-54320.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1748	2804	WerFault.exe	47
3324	2832	WerFault.exe	106

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56344.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
2888	Unicorn-267.exe
2732	Unicorn-52566.exe
2760	Unicorn-44953.exe
2656	Unicorn-9634.exe
2672	Unicorn-6105.exe
496	Unicorn-25971.exe
872	Unicorn-32092.exe
2276	Unicorn-61933.exe
2520	Unicorn-54320.exe
3036	Unicorn-24684.exe
1292	Unicorn-10028.exe
1776	Unicorn-6209.exe
3032	Unicorn-79.exe
3044	Unicorn-6209.exe
2940	Unicorn-51881.exe
2912	Unicorn-39458.exe
1944	Unicorn-48394.exe
2212	Unicorn-5315.exe
2804	Unicorn-28528.exe
2432	Unicorn-15529.exe
624	Unicorn-34366.exe
2068	Unicorn-48778.exe
1920	Unicorn-22136.exe
1052	Unicorn-30304.exe
1364	Unicorn-64352.exe
1652	Unicorn-36426.exe
948	Unicorn-56681.exe
1664	Unicorn-42556.exe
688	Unicorn-4216.exe
1056	Unicorn-8300.exe
1632	Unicorn-50423.exe
896	Unicorn-62675.exe
1536	Unicorn-42809.exe
1552	Unicorn-21643.exe
2108	Unicorn-15512.exe
1580	Unicorn-1777.exe
2144	Unicorn-64356.exe
2880	Unicorn-64621.exe
2764	Unicorn-57008.exe
2600	Unicorn-46147.exe
2652	Unicorn-17458.exe
2928	Unicorn-40693.exe
2472	Unicorn-41247.exe
2396	Unicorn-10521.exe
2404	Unicorn-15997.exe
2668	Unicorn-1606.exe
2904	Unicorn-64627.exe
2336	Unicorn-53692.exe
2044	Unicorn-8020.exe
2964	Unicorn-7755.exe
3012	Unicorn-48091.exe
2660	Unicorn-8020.exe
1108	Unicorn-8020.exe
2996	Unicorn-1890.exe
2944	Unicorn-8020.exe
2296	Unicorn-42338.exe
1532	Unicorn-21403.exe
448	Unicorn-49437.exe
2384	Unicorn-46322.exe
672	Unicorn-33978.exe
1136	Unicorn-16826.exe
2684	Unicorn-53028.exe
2380	Unicorn-7911.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2888	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	30
PID 2516 wrote to memory of 2888	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	30
PID 2516 wrote to memory of 2888	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	30
PID 2516 wrote to memory of 2888	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	30
PID 2888 wrote to memory of 2732	2888	Unicorn-267.exe	31
PID 2888 wrote to memory of 2732	2888	Unicorn-267.exe	31
PID 2888 wrote to memory of 2732	2888	Unicorn-267.exe	31
PID 2888 wrote to memory of 2732	2888	Unicorn-267.exe	31
PID 2516 wrote to memory of 2760	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	32
PID 2516 wrote to memory of 2760	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	32
PID 2516 wrote to memory of 2760	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	32
PID 2516 wrote to memory of 2760	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	32
PID 2732 wrote to memory of 2656	2732	Unicorn-52566.exe	33
PID 2732 wrote to memory of 2656	2732	Unicorn-52566.exe	33
PID 2732 wrote to memory of 2656	2732	Unicorn-52566.exe	33
PID 2732 wrote to memory of 2656	2732	Unicorn-52566.exe	33
PID 2888 wrote to memory of 2672	2888	Unicorn-267.exe	34
PID 2888 wrote to memory of 2672	2888	Unicorn-267.exe	34
PID 2888 wrote to memory of 2672	2888	Unicorn-267.exe	34
PID 2888 wrote to memory of 2672	2888	Unicorn-267.exe	34
PID 2760 wrote to memory of 496	2760	Unicorn-44953.exe	35
PID 2760 wrote to memory of 496	2760	Unicorn-44953.exe	35
PID 2760 wrote to memory of 496	2760	Unicorn-44953.exe	35
PID 2760 wrote to memory of 496	2760	Unicorn-44953.exe	35
PID 2516 wrote to memory of 872	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	36
PID 2516 wrote to memory of 872	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	36
PID 2516 wrote to memory of 872	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	36
PID 2516 wrote to memory of 872	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	36
PID 2656 wrote to memory of 2276	2656	Unicorn-9634.exe	37
PID 2656 wrote to memory of 2276	2656	Unicorn-9634.exe	37
PID 2656 wrote to memory of 2276	2656	Unicorn-9634.exe	37
PID 2656 wrote to memory of 2276	2656	Unicorn-9634.exe	37
PID 2732 wrote to memory of 2520	2732	Unicorn-52566.exe	38
PID 2732 wrote to memory of 2520	2732	Unicorn-52566.exe	38
PID 2732 wrote to memory of 2520	2732	Unicorn-52566.exe	38
PID 2732 wrote to memory of 2520	2732	Unicorn-52566.exe	38
PID 2672 wrote to memory of 3036	2672	Unicorn-6105.exe	39
PID 2672 wrote to memory of 3036	2672	Unicorn-6105.exe	39
PID 2672 wrote to memory of 3036	2672	Unicorn-6105.exe	39
PID 2672 wrote to memory of 3036	2672	Unicorn-6105.exe	39
PID 2760 wrote to memory of 2940	2760	Unicorn-44953.exe	42
PID 2760 wrote to memory of 2940	2760	Unicorn-44953.exe	42
PID 2760 wrote to memory of 2940	2760	Unicorn-44953.exe	42
PID 2760 wrote to memory of 2940	2760	Unicorn-44953.exe	42
PID 872 wrote to memory of 3044	872	Unicorn-32092.exe	40
PID 872 wrote to memory of 3044	872	Unicorn-32092.exe	40
PID 872 wrote to memory of 3044	872	Unicorn-32092.exe	40
PID 872 wrote to memory of 3044	872	Unicorn-32092.exe	40
PID 496 wrote to memory of 1776	496	Unicorn-25971.exe	41
PID 496 wrote to memory of 1776	496	Unicorn-25971.exe	41
PID 496 wrote to memory of 1776	496	Unicorn-25971.exe	41
PID 496 wrote to memory of 1776	496	Unicorn-25971.exe	41
PID 2888 wrote to memory of 3032	2888	Unicorn-267.exe	43
PID 2888 wrote to memory of 3032	2888	Unicorn-267.exe	43
PID 2888 wrote to memory of 3032	2888	Unicorn-267.exe	43
PID 2888 wrote to memory of 3032	2888	Unicorn-267.exe	43
PID 2516 wrote to memory of 1292	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	44
PID 2516 wrote to memory of 1292	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	44
PID 2516 wrote to memory of 1292	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	44
PID 2516 wrote to memory of 1292	2516	0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe	44
PID 2276 wrote to memory of 2912	2276	Unicorn-61933.exe	45
PID 2276 wrote to memory of 2912	2276	Unicorn-61933.exe	45
PID 2276 wrote to memory of 2912	2276	Unicorn-61933.exe	45
PID 2276 wrote to memory of 2912	2276	Unicorn-61933.exe	45

C:\Users\Admin\AppData\Local\Temp\0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe
"C:\Users\Admin\AppData\Local\Temp\0381d16116c3d0597e567e155fed8c5181316ea69a4a46e37891af2877d9cb5f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52566.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61933.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        9⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
        9⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        9⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6998.exe
        9⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49366.exe
        9⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        9⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        9⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        8⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        8⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13569.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3863.exe
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        8⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        8⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        8⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22022.exe
        8⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        8⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        8⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49366.exe
        8⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        8⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        8⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49896.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        7⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37123.exe
        7⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        8⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe
        9⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        8⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        8⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        8⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        7⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47056.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
        8⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe
        8⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51842.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        7⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53359.exe
        6⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        7⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40783.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        6⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
        6⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28528.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 240
        6⤵
        Program crash
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15512.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13687.exe
        6⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55078.exe
        7⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        7⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
        7⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exe
        6⤵
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13569.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3863.exe
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        6⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59138.exe
        6⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37927.exe
        5⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        6⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61129.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        6⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        6⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16983.exe
        5⤵
        
        PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15542.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
        5⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
        5⤵
        
        PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48394.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50423.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36329.exe
        8⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2266.exe
        9⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        9⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        9⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53791.exe
        8⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        8⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6998.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18639.exe
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
        8⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        7⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47282.exe
        8⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        8⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12103.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27084.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exe
        7⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        7⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        7⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe
        6⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57794.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        6⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        7⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        7⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
        7⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        6⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        6⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
        6⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46322.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        6⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
        7⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        7⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        7⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        6⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        6⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25846.exe
        6⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58414.exe
        6⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        5⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        6⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
        5⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24945.exe
        5⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
        5⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
        5⤵
        
        PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21643.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        6⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5130.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        7⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58414.exe
        7⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
        6⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        5⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4891.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4877.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        6⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47377.exe
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exe
        6⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51662.exe
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57794.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        5⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4069.exe
        5⤵
        
        PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
        7⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6048.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16761.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        6⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        6⤵
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        6⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        6⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
        5⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        5⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
        5⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
        5⤵
        
        PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
      4⤵
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9442.exe
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
        5⤵
        
        PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
      4⤵
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36855.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49205.exe
      4⤵
      PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29145.exe
      4⤵
      PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
      4⤵
      PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
      4⤵
      PID:8572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15529.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64621.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
        7⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
        8⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        8⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        8⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        8⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        8⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29207.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        7⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37227.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        7⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25395.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        7⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16501.exe
        7⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        7⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        6⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        6⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        6⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25395.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        7⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        7⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        6⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
        6⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        6⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        5⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        6⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        6⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        6⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        5⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        5⤵
        
        PID:8756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34366.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46147.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        6⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15237.exe
        7⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
        7⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        6⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12571.exe
        5⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61880.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
        5⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        5⤵
        
        PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17458.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        5⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        6⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        6⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31866.exe
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        6⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22960.exe
        5⤵
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
        5⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        5⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        5⤵
        
        PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18876.exe
      4⤵
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26553.exe
        5⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
        5⤵
        
        PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1704.exe
      4⤵
      PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28800.exe
      4⤵
      PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13661.exe
      4⤵
      PID:8892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39126.exe
        7⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        7⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        7⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
        7⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13614.exe
        6⤵
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        6⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-298.exe
        5⤵
        Executes dropped EXE
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        6⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49366.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        6⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        5⤵
        
        PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        5⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49896.exe
        5⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        5⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        5⤵
        
        PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exe
        5⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25607.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52166.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        6⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
        5⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23594.exe
        5⤵
        
        PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
      4⤵
      PID:648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        5⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
        5⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
        5⤵
        
        PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7854.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51419.exe
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
      4⤵
      PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
      4⤵
      PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-125.exe
      4⤵
      PID:8780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52042.exe
        5⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17636.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37227.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34776.exe
        5⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        5⤵
        
        PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        5⤵
        
        PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54782.exe
      4⤵
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31047.exe
        5⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
        5⤵
        
        PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2417.exe
      4⤵
      PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
      4⤵
      PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
      4⤵
      PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
      4⤵
      PID:8764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
      4⤵
      PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6998.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
      4⤵
      PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
      4⤵
      PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
      4⤵
      PID:8016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
    3⤵
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59610.exe
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18697.exe
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10892.exe
    3⤵
    PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63987.exe
    3⤵
    PID:6672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
    3⤵
    PID:6312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59527.exe
    3⤵
    PID:7384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
    3⤵
    PID:8300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6209.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        6⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49240.exe
        7⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
        7⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe
        6⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28476.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25392.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        6⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        6⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60842.exe
        5⤵
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18814.exe
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        6⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        5⤵
        
        PID:8632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8300.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        6⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        7⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12191.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49896.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        6⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27755.exe
        5⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27305.exe
        6⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40783.exe
        6⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1326.exe
        6⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15035.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        5⤵
        
        PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe
      4⤵
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57517.exe
        5⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46478.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
        5⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        5⤵
        
        PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        5⤵
        
        PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6485.exe
      4⤵
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42544.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
      4⤵
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
      4⤵
      PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
      4⤵
      PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
      4⤵
      PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
      4⤵
      PID:8724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51881.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30304.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
        6⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 240
        7⤵
        Program crash
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25341.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
        6⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
        6⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        6⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60345.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39510.exe
        6⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20398.exe
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        6⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        6⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45542.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        5⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        5⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2286.exe
        6⤵
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16501.exe
        6⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
        6⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        6⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57794.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        5⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
        5⤵
        
        PID:8860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60541.exe
      4⤵
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        5⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18460.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        5⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42561.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
      4⤵
      PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
      4⤵
      PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
      4⤵
      PID:8836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
        5⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45125.exe
        6⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
        5⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        5⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
        5⤵
        
        PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
      4⤵
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11606.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
        5⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
        5⤵
        
        PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8766.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21115.exe
      4⤵
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
      4⤵
      PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
      4⤵
      PID:7472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
      4⤵
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        5⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        5⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1326.exe
        5⤵
        
        PID:9048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
      4⤵
      PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
      4⤵
      PID:7592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16049.exe
    3⤵
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13578.exe
      4⤵
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        5⤵
        
        PID:8304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
      4⤵
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42193.exe
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
      4⤵
      PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
      4⤵
      PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
      4⤵
      PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
      4⤵
      PID:8400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12617.exe
    3⤵
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57313.exe
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
      4⤵
      PID:8944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54861.exe
    3⤵
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
    3⤵
    PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34305.exe
    3⤵
    PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38248.exe
    3⤵
    PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44201.exe
    3⤵
    PID:7604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
    3⤵
    PID:8912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32092.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32092.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6209.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
        5⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36049.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        6⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10335.exe
        6⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        6⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43769.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        5⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        5⤵
        
        PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
      4⤵
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25395.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        5⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14800.exe
        5⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        5⤵
        
        PID:8324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25130.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
      4⤵
      PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
      4⤵
      PID:7948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe
      4⤵
      PID:9148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        5⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10631.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28777.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        6⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62062.exe
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
        6⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        5⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        5⤵
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61238.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19399.exe
      4⤵
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57794.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
      4⤵
      PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
      4⤵
      PID:7700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1890.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
      4⤵
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        5⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        5⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        5⤵
        
        PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
      4⤵
      PID:756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
      4⤵
      PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
      4⤵
      PID:7864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3993.exe
    3⤵
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exe
      4⤵
      PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
      4⤵
      PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58893.exe
    3⤵
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21932.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
    3⤵
    PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
    3⤵
    PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
    3⤵
    PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
    3⤵
    PID:7912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
    3⤵
    PID:9168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
      4⤵
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        5⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        5⤵
        
        PID:8680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19264.exe
      4⤵
      PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34460.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21439.exe
        5⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        5⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31335.exe
        5⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32968.exe
        5⤵
        
        PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44990.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
      4⤵
      PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
      4⤵
      PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
    3⤵
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13661.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
      4⤵
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8326.exe
      4⤵
      PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
      4⤵
      PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
      4⤵
      PID:7408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
    3⤵
    PID:2848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
    3⤵
    PID:3272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
    3⤵
    PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65122.exe
    3⤵
    PID:6656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
    3⤵
    PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
    3⤵
    PID:7984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51272.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
      4⤵
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44918.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
        5⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52662.exe
        5⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        5⤵
        
        PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
      4⤵
      PID:7532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17833.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36234.exe
      4⤵
      PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
      4⤵
      PID:7696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exe
    3⤵
    PID:3228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
    3⤵
    PID:4644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37227.exe
    3⤵
    PID:5460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65503.exe
    3⤵
    PID:6544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41313.exe
    3⤵
    PID:7256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
    3⤵
    PID:8040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
    3⤵
    PID:9012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
    3⤵
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
    3⤵
    PID:3736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
    3⤵
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19250.exe
    3⤵
    PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20585.exe
    3⤵
    PID:6716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24247.exe
    3⤵
    PID:6992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
    3⤵
    PID:7824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
    3⤵
    PID:9004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17129.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17129.exe
  2⤵
  PID:1600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54861.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54861.exe
  2⤵
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
  2⤵
  PID:5864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38248.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38248.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9390.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9390.exe
  2⤵
  PID:7400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
  2⤵
  PID:8932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12191.exe

Filesize
468KB

MD5
fb8353e075c1f8d0cae15128844f04de

SHA1
743205442355396a610193abed9e76ceadda9b7d

SHA256
090f49901d13d6f957cf71dc72e1a8608f9a7cb6e6cba1bcea476f17eeede7b4

SHA512
dd27c45c1e34995507a4d02ed2ba6935fe265e92027fd8a4f3e9644122206799b53a3fcfc45707fd0890aebf77f3ba2aa38dcfa6858514986ad605dd3017039c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe

Filesize
468KB

MD5
a610dafb760f99628b198ae2ae34b850

SHA1
29f37db52aa5f44bca96acc5f4502308d008e2c4

SHA256
855d42e56d31003a011ec5a0d387d29e49d739eef0a78ec6ba3674d278b7f902

SHA512
94ad4821a6e5795d486ad6b7011c8d8b0278edfaeae99ed7143536319859fe60e1f6c1d36d55ae102e8b79f5fd77561dfc89dedf7fb27c3d2f18a710b35346de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28528.exe

Filesize
468KB

MD5
ef9baab93bde50eeb19c5cc18fd2fcc5

SHA1
0929e468a3bf829ec2be6334c868f9f2de43c6d7

SHA256
f06f867e335e5cfd5b0ed3465ca8ddd4e160e62b6af0d275b433fb3786d9e051

SHA512
798b4dc983b6bdf17e07a78f50316918be84aa1f6d1c2c434f56ae0c6004e7800e9b8ad5faa0fbf651ed4ec672d012e9c1261235a4cb424b887193cd6f3b1f1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe

Filesize
468KB

MD5
cb1754874142bcc72592c8a21cf2c832

SHA1
9372fc0fd21e543c640a01b4799e9c47e5804948

SHA256
9fe06d55d71d51af37c9731156072f7d921b6dccf868ac3bfec726d49d7e0d13

SHA512
b5f958315b7b0f5a6a3bce3fb3158a70a282dbb7ad9871ec20c06c4d493aeed33b0eb9784ba863a0a8b4999c4803928a34bc3cdc809c3ff14f0d9df35e15192e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51881.exe

Filesize
468KB

MD5
756904f2ebb1e88194a7cf72d89cfb7f

SHA1
d7c153d3382036157861886470af54328bf6cc91

SHA256
ad4b40371ca5265c2f2c9f83049274a1dbe5219c3f3ecb0e249e0c9543d84044

SHA512
8f166f8d99b96a4035944fbf24c7202ead4503b0d6b159b3326565696d4640516205a0f7e78018d13de9a19aa5506ca9e798bcb74ec2e3fcbe3b28cae7087575

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52566.exe

Filesize
468KB

MD5
7b0f740e52c0987c8ee5bb8dac97a584

SHA1
6c2cd529d9e48d2f665661f591ebc41faeb1b1f9

SHA256
6880fca3a6c444fb7b28ed86c90031cffb0a0ce1b262c432e5ea66d0f4bf7cec

SHA512
decc0ab7ef3297fc169f35df7a4c399938b7b7d8a79ea067fc343f29832990bd8ebef0abe5206d85355c56e5932e2cf4c2cc3c5202b64afbc1c2a4a3b3064781

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe

Filesize
468KB

MD5
f5475b340fa9b385b745b6c802d13705

SHA1
87b3335ffc1c8014f24fcfd62c3f2fe73fb76a77

SHA256
bbd0ae116068f17fe9844921b97a4c0de3cd35300233be028ddca48a4bfcd114

SHA512
f126ac02ffd3b6a0feedd4fa5b2087dbc2ffdcb0d341aeb95b314c61c063d554804d178c08127cef8b531dfb4bcaeb7c971da4191482af7ef71727c218b4fc73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62062.exe

Filesize
468KB

MD5
baee4b55824efb6ebd9c1c3595f0d187

SHA1
58795b72e2e58bb4d24bd82d2cccff671b42219e

SHA256
4c6b2eb8eccc1ae0f9540cf815aab3f75b767d1f04b03dbd2ceb033955ccf2f4

SHA512
ddd25d1bc6bebab81d6d342968d4d94ce08f80d4a4964d0734c62cce811d04f2a45478f2e9aab278949ad96540b66638d62528d73a18697cb56c81718ad27c9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe

Filesize
468KB

MD5
2faaa63aee8634f5f04a2b42926f6280

SHA1
ac83b258c2e4cca808095460f8ce35bca54548f8

SHA256
fa4915afed8215862ec65edf07e7a6c681432a37c7f30f9f94ce2ecc1faaf31a

SHA512
8ab144a596efa11a527e4b802cf3eec892dd5c8407adbceb9a872a27eaf0d08fb7c5c152dd25b48d12ae8779336c17b6e3ea9bda55ae4cdee6647e913a831400

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe

Filesize
468KB

MD5
d20b5700e72cae3d26efc69dff0e1dbf

SHA1
577f5aa82cff6a62b36281cc1937c6689e35de7c

SHA256
d71ccd5640fbaeaac15d0649057cd1191bcbfcdfc576066a8542782613af0440

SHA512
ce62081cca8556dcd762f93d2f9b115fb068e280070dd44579ddb1628ff2e3deac2125811cb75e8e5b5af13712b6921de8d3df1b12d0e3371d3b4760cf6ebc02

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe

Filesize
468KB

MD5
54b4b7c78459d4ea31b441bf0ad5a0a3

SHA1
2f13a24fb62a871c7ef088f11e5b7cf28f1db9b5

SHA256
60a7b9097ad820a961e9c9aee3afc7d8d6feaae7ad5093cf4aa0432f8bf32917

SHA512
fc332a6ddd2322fcd486de48619aa2a2b4f9d8ab6ae8fe6dff5090b727d6951e1f0e4596f4fb7d96ae7edda9e6950921e4061ec8415628fb5502c56827686458

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-267.exe

Filesize
468KB

MD5
e1e817f57e2ae8102df4768228dc3e66

SHA1
79d976d445f1c2e622cef6c71492733ee516b6ef

SHA256
ce5fc14eb27db8ab3f5b48afb081490bef7a3776564581e3e55c9575bd0a4217

SHA512
40ef785d42aa9c6b95473a6190994e9d54eb5b66dd69254b574a82e16061f8ee32fc5d1e3245223230b7036d13c95d568cef024241cf9d27d82c7e52f0afb3d7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32092.exe

Filesize
468KB

MD5
f3337da20c5bff6176e7d4fcd7598c6b

SHA1
e5596c05770807f397a0e252507fa11796490e04

SHA256
41f2549df926ca8a44f8765098e255579c89f992a3f3b3dcfeaede1a8ea2b3ad

SHA512
d52c55e0cc7826ad8717b0561b4561ef103e2d327a165ac9c1dc8b6191d0f71829b5c528cae7801686481214cd8101700d9b745528473bbe28a1c0d8a9740720

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe

Filesize
468KB

MD5
e11bee8c22a09b6659fe0981d6d9d486

SHA1
654b6c7c886f86b6030507aaee0d2f68c0afe905

SHA256
ccb3bb1c01cf0ba852f205e9db1a4d75fc53b6feba8380ef1f8860af4374890c

SHA512
6ca978e9cb26b2491d6e55798ef23ac489bba58e628b491e12437a379694b22b33e5a9aebea58b7a19d9345910b8ea45b7eaad16c51fcfb44e1ab15d9ba0015d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe

Filesize
468KB

MD5
c96fd8f7a38e78454b48740fed1a36e1

SHA1
b9b7d3a4d46387147e73a845d2d0af94decfdb04

SHA256
a3e6189f61a17a7293f402a4a5deaf8dd1beb53ab237cd8300b5f122b6abfde3

SHA512
6e67ecabbde9f510d62145c4fdec69a0c2e0e0f6ce26c5dccc6ad43a66a2706ea17e074d909f8665533d34528303973e9b5e31bc1a03c20df2d84bfbddb48841

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48394.exe

Filesize
468KB

MD5
e04e30072d0d94685b429f8e390fdccf

SHA1
8ccb9bd689d7ebab7a4b5727a6748145d5372d6e

SHA256
ec548fcca14b02d9471184ab6d7ebdc9593dbf00e73aa9bbefae31106ca4a57b

SHA512
bc2e6631c7f4e436948346118c0a15e6db5117bb659be4ae074d362cdcba4670141d3c7f69d4200f6785c1ec259def39a535139b6972bd9688329d48861d25fc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe

Filesize
468KB

MD5
62511d2c9464f178ef0a1008a93f8d04

SHA1
3dcefcec94709492f67b1380b913789bcb12e951

SHA256
9681537831d5846a7a3953f0e4e49b39fc8efcf41700a86c03d9655f07fa135b

SHA512
b9a9613dbfad996d1336db5c1a6885a700109ef3492e93d0db62c20d6f853c3945123912367100d845968e0431be3bd821eda6b6658941a784a3f0b2abb69c26

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe

Filesize
468KB

MD5
f40daf79de3243ef62a7c777da893a88

SHA1
fbf8f64fc312cb85eea5d91d779325b742c18c7a

SHA256
302873191ce980ed38d1c018fcdb5bd0a62109354d6146336be2236757443e0a

SHA512
fe9801a33d42ebbe90c31d4703f625e7862f4999e2a59a18a2ad3d8e17d8d67a4310df50089eaf1ecd4ceddf0c47d6c0b197fbaa35b1a8c16a6c9f29264b50d1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61933.exe

Filesize
468KB

MD5
e0496fbd7d8accde0870ecbcb7952821

SHA1
290d9065e669ef74f783440957908a075e8d6097

SHA256
a8083763f8a1034b4182caa1ea9597a1f5689d488328c7e6a0f9c8c7458db60e

SHA512
f47b4f30858cf8229be7d6ab9d0ef7234a42fe0ad2e6e728b7f167477da5f143f4d5782bacf3554a54736248f519b9a91a149b44a8428e3d7aa629906d59c95f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6209.exe

Filesize
468KB

MD5
86c16ad9739c36a9bf16a4439e8c06dd

SHA1
5c63b843709e4ec08e983f540b06d87c2ebb2267

SHA256
02370b074d3244ac4235931a9f4e488c443abd09ee43dabaae491b5c92b09c1f

SHA512
eddbb16ee73b54629c4daaed78b7b8ccb1cad78d38d6878e084ed30f95283086d45cd17052282d65b327d1f9fa37cdc229e539747bdeb178f5948ddee23bfb00

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe

Filesize
468KB

MD5
ac5ec1f194f0ecfbe246b73ac8494c99

SHA1
86bceca6fcedb1c6870da19b7bc67cedd1676825

SHA256
c75fd58a392e4f8a35674b5a77c32c0a419010511ed23369eee29df565a22ba6

SHA512
72236fa096dcb7e34fd37160743ee61da62ccce094e0781b815070a9409180e613b9084640ee192819e4ad9f92ce170dd06a886c7ffb209ed2f4668e347c1ad2

Download Submit