55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
Size

468KB
MD5

7a3b0d781bddf5401c25c8a265b35034
SHA1

7ad5d41c35b3f2af4a77050ef96c9e65d73844b0
SHA256

55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81
SHA512

16529814d758e85eed45c21adfb081fcefe4a0549218212b62aa6256ed61cef4b653de4e015d24426bfe674fc7d5c2a8c26eb94772cf04e579fe98c6989833b1
SSDEEP

3072:uTAyoSCVIdiUUbYcPzt1cf8/iCMvtgpwVmHe9v1PAZ8JyyaQTlP:uT9oQwUUnPJ1cfJcQrPAm8yaQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2556	Unicorn-5283.exe
2080	Unicorn-38039.exe
1960	Unicorn-14089.exe
2776	Unicorn-23732.exe
2928	Unicorn-62626.exe
2708	Unicorn-9433.exe
2756	Unicorn-61235.exe
2692	Unicorn-8511.exe
2300	Unicorn-46015.exe
1348	Unicorn-53628.exe
1508	Unicorn-58843.exe
1900	Unicorn-9087.exe
1884	Unicorn-9087.exe
2144	Unicorn-29599.exe
1228	Unicorn-41495.exe
2988	Unicorn-9362.exe
1872	Unicorn-29682.exe
2140	Unicorn-35813.exe
1076	Unicorn-11671.exe
1748	Unicorn-54095.exe
1804	Unicorn-17893.exe
1920	Unicorn-11116.exe
2824	Unicorn-56809.exe
1688	Unicorn-50679.exe
1540	Unicorn-62269.exe
576	Unicorn-5662.exe
1652	Unicorn-62574.exe
2200	Unicorn-1386.exe
3048	Unicorn-62839.exe
2444	Unicorn-38889.exe
2124	Unicorn-26637.exe
1376	Unicorn-39980.exe
2392	Unicorn-3778.exe
2400	Unicorn-23644.exe
2088	Unicorn-54178.exe
2344	Unicorn-19102.exe
2760	Unicorn-5724.exe
2768	Unicorn-1661.exe
2752	Unicorn-22636.exe
2736	Unicorn-38418.exe
2644	Unicorn-34233.exe
2960	Unicorn-13721.exe
2964	Unicorn-1469.exe
2480	Unicorn-50478.exe
2740	Unicorn-44348.exe
1064	Unicorn-58738.exe
1736	Unicorn-40918.exe
1588	Unicorn-53192.exe
1840	Unicorn-12906.exe
1124	Unicorn-6129.exe
1328	Unicorn-51054.exe
1864	Unicorn-27104.exe
1984	Unicorn-44062.exe
2720	Unicorn-26550.exe
2096	Unicorn-51609.exe
2028	Unicorn-5937.exe
2984	Unicorn-5672.exe
756	Unicorn-1753.exe
2808	Unicorn-38610.exe
1292	Unicorn-38610.exe
1056	Unicorn-48101.exe
2440	Unicorn-24225.exe
1888	Unicorn-6321.exe
1672	Unicorn-27296.exe

Loads dropped DLL 64 IoCs

pid	Process
2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
2556	Unicorn-5283.exe
2556	Unicorn-5283.exe
2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
1960	Unicorn-14089.exe
2080	Unicorn-38039.exe
1960	Unicorn-14089.exe
2080	Unicorn-38039.exe
2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
2556	Unicorn-5283.exe
2556	Unicorn-5283.exe
2776	Unicorn-23732.exe
2776	Unicorn-23732.exe
2080	Unicorn-38039.exe
2928	Unicorn-62626.exe
2080	Unicorn-38039.exe
2928	Unicorn-62626.exe
1960	Unicorn-14089.exe
1960	Unicorn-14089.exe
2756	Unicorn-61235.exe
2708	Unicorn-9433.exe
2756	Unicorn-61235.exe
2708	Unicorn-9433.exe
2556	Unicorn-5283.exe
2556	Unicorn-5283.exe
2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
2300	Unicorn-46015.exe
2300	Unicorn-46015.exe
2692	Unicorn-8511.exe
2080	Unicorn-38039.exe
2080	Unicorn-38039.exe
2692	Unicorn-8511.exe
2776	Unicorn-23732.exe
2776	Unicorn-23732.exe
1348	Unicorn-53628.exe
1348	Unicorn-53628.exe
2928	Unicorn-62626.exe
2928	Unicorn-62626.exe
1508	Unicorn-58843.exe
1508	Unicorn-58843.exe
1228	Unicorn-41495.exe
1960	Unicorn-14089.exe
1228	Unicorn-41495.exe
1960	Unicorn-14089.exe
2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
2144	Unicorn-29599.exe
2144	Unicorn-29599.exe
2556	Unicorn-5283.exe
2556	Unicorn-5283.exe
1900	Unicorn-9087.exe
1900	Unicorn-9087.exe
1884	Unicorn-9087.exe
1884	Unicorn-9087.exe
2708	Unicorn-9433.exe
2708	Unicorn-9433.exe
2756	Unicorn-61235.exe
2756	Unicorn-61235.exe
2988	Unicorn-9362.exe
2988	Unicorn-9362.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1812	2440	WerFault.exe	92
3372	3004	WerFault.exe	115
5892	1524	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53989.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
2556	Unicorn-5283.exe
1960	Unicorn-14089.exe
2080	Unicorn-38039.exe
2776	Unicorn-23732.exe
2928	Unicorn-62626.exe
2756	Unicorn-61235.exe
2708	Unicorn-9433.exe
2692	Unicorn-8511.exe
2300	Unicorn-46015.exe
1348	Unicorn-53628.exe
1508	Unicorn-58843.exe
1228	Unicorn-41495.exe
1900	Unicorn-9087.exe
1884	Unicorn-9087.exe
2144	Unicorn-29599.exe
2988	Unicorn-9362.exe
2140	Unicorn-35813.exe
1872	Unicorn-29682.exe
1076	Unicorn-11671.exe
1748	Unicorn-54095.exe
1804	Unicorn-17893.exe
1920	Unicorn-11116.exe
2824	Unicorn-56809.exe
1688	Unicorn-50679.exe
1540	Unicorn-62269.exe
2200	Unicorn-1386.exe
576	Unicorn-5662.exe
1652	Unicorn-62574.exe
3048	Unicorn-62839.exe
2124	Unicorn-26637.exe
2444	Unicorn-38889.exe
1376	Unicorn-39980.exe
2392	Unicorn-3778.exe
2400	Unicorn-23644.exe
2088	Unicorn-54178.exe
2344	Unicorn-19102.exe
2760	Unicorn-5724.exe
2768	Unicorn-1661.exe
2736	Unicorn-38418.exe
2752	Unicorn-22636.exe
2644	Unicorn-34233.exe
2964	Unicorn-1469.exe
2960	Unicorn-13721.exe
2480	Unicorn-50478.exe
1064	Unicorn-58738.exe
2740	Unicorn-44348.exe
1588	Unicorn-53192.exe
1736	Unicorn-40918.exe
1840	Unicorn-12906.exe
1124	Unicorn-6129.exe
1328	Unicorn-51054.exe
1984	Unicorn-44062.exe
1864	Unicorn-27104.exe
2720	Unicorn-26550.exe
2096	Unicorn-51609.exe
2028	Unicorn-5937.exe
2984	Unicorn-5672.exe
1292	Unicorn-38610.exe
2808	Unicorn-38610.exe
756	Unicorn-1753.exe
1056	Unicorn-48101.exe
2440	Unicorn-24225.exe
1888	Unicorn-6321.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2556	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	31
PID 2148 wrote to memory of 2556	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	31
PID 2148 wrote to memory of 2556	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	31
PID 2148 wrote to memory of 2556	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	31
PID 2556 wrote to memory of 2080	2556	Unicorn-5283.exe	32
PID 2556 wrote to memory of 2080	2556	Unicorn-5283.exe	32
PID 2556 wrote to memory of 2080	2556	Unicorn-5283.exe	32
PID 2556 wrote to memory of 2080	2556	Unicorn-5283.exe	32
PID 2148 wrote to memory of 1960	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	33
PID 2148 wrote to memory of 1960	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	33
PID 2148 wrote to memory of 1960	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	33
PID 2148 wrote to memory of 1960	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	33
PID 1960 wrote to memory of 2928	1960	Unicorn-14089.exe	34
PID 1960 wrote to memory of 2928	1960	Unicorn-14089.exe	34
PID 1960 wrote to memory of 2928	1960	Unicorn-14089.exe	34
PID 1960 wrote to memory of 2928	1960	Unicorn-14089.exe	34
PID 2080 wrote to memory of 2776	2080	Unicorn-38039.exe	35
PID 2080 wrote to memory of 2776	2080	Unicorn-38039.exe	35
PID 2080 wrote to memory of 2776	2080	Unicorn-38039.exe	35
PID 2080 wrote to memory of 2776	2080	Unicorn-38039.exe	35
PID 2148 wrote to memory of 2708	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	36
PID 2148 wrote to memory of 2708	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	36
PID 2148 wrote to memory of 2708	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	36
PID 2148 wrote to memory of 2708	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	36
PID 2556 wrote to memory of 2756	2556	Unicorn-5283.exe	37
PID 2556 wrote to memory of 2756	2556	Unicorn-5283.exe	37
PID 2556 wrote to memory of 2756	2556	Unicorn-5283.exe	37
PID 2556 wrote to memory of 2756	2556	Unicorn-5283.exe	37
PID 2776 wrote to memory of 2692	2776	Unicorn-23732.exe	38
PID 2776 wrote to memory of 2692	2776	Unicorn-23732.exe	38
PID 2776 wrote to memory of 2692	2776	Unicorn-23732.exe	38
PID 2776 wrote to memory of 2692	2776	Unicorn-23732.exe	38
PID 2080 wrote to memory of 2300	2080	Unicorn-38039.exe	39
PID 2080 wrote to memory of 2300	2080	Unicorn-38039.exe	39
PID 2080 wrote to memory of 2300	2080	Unicorn-38039.exe	39
PID 2080 wrote to memory of 2300	2080	Unicorn-38039.exe	39
PID 2928 wrote to memory of 1348	2928	Unicorn-62626.exe	40
PID 2928 wrote to memory of 1348	2928	Unicorn-62626.exe	40
PID 2928 wrote to memory of 1348	2928	Unicorn-62626.exe	40
PID 2928 wrote to memory of 1348	2928	Unicorn-62626.exe	40
PID 1960 wrote to memory of 1508	1960	Unicorn-14089.exe	41
PID 1960 wrote to memory of 1508	1960	Unicorn-14089.exe	41
PID 1960 wrote to memory of 1508	1960	Unicorn-14089.exe	41
PID 1960 wrote to memory of 1508	1960	Unicorn-14089.exe	41
PID 2756 wrote to memory of 1884	2756	Unicorn-61235.exe	42
PID 2756 wrote to memory of 1884	2756	Unicorn-61235.exe	42
PID 2756 wrote to memory of 1884	2756	Unicorn-61235.exe	42
PID 2756 wrote to memory of 1884	2756	Unicorn-61235.exe	42
PID 2708 wrote to memory of 1900	2708	Unicorn-9433.exe	43
PID 2708 wrote to memory of 1900	2708	Unicorn-9433.exe	43
PID 2708 wrote to memory of 1900	2708	Unicorn-9433.exe	43
PID 2708 wrote to memory of 1900	2708	Unicorn-9433.exe	43
PID 2556 wrote to memory of 2144	2556	Unicorn-5283.exe	44
PID 2556 wrote to memory of 2144	2556	Unicorn-5283.exe	44
PID 2556 wrote to memory of 2144	2556	Unicorn-5283.exe	44
PID 2556 wrote to memory of 2144	2556	Unicorn-5283.exe	44
PID 2148 wrote to memory of 1228	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	45
PID 2148 wrote to memory of 1228	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	45
PID 2148 wrote to memory of 1228	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	45
PID 2148 wrote to memory of 1228	2148	55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe	45
PID 2300 wrote to memory of 2988	2300	Unicorn-46015.exe	46
PID 2300 wrote to memory of 2988	2300	Unicorn-46015.exe	46
PID 2300 wrote to memory of 2988	2300	Unicorn-46015.exe	46
PID 2300 wrote to memory of 2988	2300	Unicorn-46015.exe	46

C:\Users\Admin\AppData\Local\Temp\55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe
"C:\Users\Admin\AppData\Local\Temp\55e9b69911099c660d93236207a69b92a637eda326a2d581f48af4b21b56bd81.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38039.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23732.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        8⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35377.exe
        9⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        10⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        10⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
        10⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        10⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1930.exe
        10⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        10⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        9⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        9⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        9⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        9⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        9⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        9⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        9⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
        8⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56854.exe
        9⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49039.exe
        9⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        8⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
        8⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35809.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        7⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        8⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32133.exe
        8⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54084.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
        7⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
        8⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        8⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
        8⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        7⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        7⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        7⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        6⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        7⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        7⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10161.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15772.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
        6⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18188.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11671.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1469.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        7⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        8⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        8⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9727.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        8⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1930.exe
        8⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
        8⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        7⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        7⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        6⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17034.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        6⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        6⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        6⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        5⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7368.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
        5⤵
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20270.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33893.exe
        5⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46015.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        8⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39102.exe
        8⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        8⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1084.exe
        8⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        8⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38256.exe
        7⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        7⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27296.exe
        6⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        7⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        7⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32064.exe
        6⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
        6⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61057.exe
        6⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
        6⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        7⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
        7⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48002.exe
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48832.exe
        6⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53989.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18296.exe
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        6⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7094.exe
        5⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        5⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31509.exe
        5⤵
        
        PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29682.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23644.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        6⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
        7⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        6⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10161.exe
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23394.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19812.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        5⤵
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33348.exe
        5⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        6⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17034.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22657.exe
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17250.exe
        6⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
        5⤵
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
        5⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        5⤵
        
        PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
      4⤵
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        5⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        5⤵
        
        PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
      4⤵
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        5⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
      4⤵
      PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
      4⤵
      PID:7612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1386.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe
        6⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53989.exe
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        7⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        6⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16248.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        6⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17034.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22657.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        5⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41011.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22083.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20270.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32996.exe
        5⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
        5⤵
        
        PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5937.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30305.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        6⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34131.exe
        5⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
        5⤵
        
        PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1753.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50561.exe
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20902.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        5⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26247.exe
        5⤵
        
        PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
      4⤵
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exe
        5⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
        5⤵
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47439.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
      4⤵
      PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
      4⤵
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
      4⤵
      PID:6508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5662.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6129.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        6⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60347.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        6⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        6⤵
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-732.exe
        5⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32133.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        5⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        5⤵
        
        PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27104.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17034.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22657.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19056.exe
        5⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
      4⤵
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43069.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-296.exe
      4⤵
      PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
      4⤵
      PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
      4⤵
      PID:6808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62574.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62774.exe
        6⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        5⤵
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        5⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        5⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
      4⤵
      PID:3004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 200
        5⤵
        Program crash
        
        PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      4⤵
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
      4⤵
      PID:680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
      4⤵
      PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
      4⤵
      PID:7300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 240
      4⤵
      Program crash
      PID:1812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
    3⤵
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
    3⤵
    PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14935.exe
    3⤵
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36042.exe
    3⤵
    PID:5572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5260.exe
    3⤵
    PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
    3⤵
    PID:7180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62626.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1661.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        7⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        7⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        6⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        6⤵
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53380.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1746.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26247.exe
        6⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        5⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        6⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1238.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7094.exe
        5⤵
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30373.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17893.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        6⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4649.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe
        7⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        6⤵
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49409.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-193.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2829.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6212.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        6⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe
        7⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
        7⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        6⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        7⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        6⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
        5⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        6⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64282.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9222.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55148.exe
      4⤵
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        5⤵
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
        5⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24391.exe
        5⤵
        
        PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
      4⤵
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1567.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
      4⤵
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8073.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58843.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        6⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36370.exe
        7⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1930.exe
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
        7⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        6⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        5⤵
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53989.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40009.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        6⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21118.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22657.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        5⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        6⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        5⤵
        
        PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        5⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        5⤵
        
        PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34446.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38702.exe
        5⤵
        
        PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30373.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
      4⤵
      PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26550.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        5⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
        5⤵
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23508.exe
      4⤵
      PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16248.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
      4⤵
      PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5672.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
      4⤵
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
      4⤵
      PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
      4⤵
      PID:1332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
    3⤵
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20270.exe
    3⤵
    PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
    3⤵
    PID:5500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
    3⤵
    PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23447.exe
    3⤵
    PID:7564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60073.exe
        6⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63797.exe
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63975.exe
        7⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 200
        6⤵
        Program crash
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16248.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        5⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        5⤵
        
        PID:7760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60073.exe
        5⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31143.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10595.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33569.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        5⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        5⤵
        
        PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        5⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7094.exe
      4⤵
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38967.exe
      4⤵
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe
      4⤵
      PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
      4⤵
      PID:6844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        5⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
        5⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        5⤵
        
        PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
      4⤵
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44661.exe
      4⤵
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2376.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6927.exe
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
      4⤵
      PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
      4⤵
      PID:7656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
    3⤵
    PID:2932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48002.exe
    3⤵
    PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
    3⤵
    PID:6272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
    3⤵
    PID:7516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41495.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41495.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        5⤵
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15718.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        5⤵
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
      4⤵
      PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35809.exe
      4⤵
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12906.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        5⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
      4⤵
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
      4⤵
      PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
      4⤵
      PID:7704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58650.exe
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26768.exe
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
    3⤵
    PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
    3⤵
    PID:6716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
    3⤵
    PID:6684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54368.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57547.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
      4⤵
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
      4⤵
      PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe
      4⤵
      PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
      4⤵
      PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10514.exe
    3⤵
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
    3⤵
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
    3⤵
    PID:5172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
    3⤵
    PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
    3⤵
    PID:5564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44062.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44062.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
    3⤵
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58790.exe
      4⤵
      PID:8036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4837.exe
    3⤵
    PID:4012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
    3⤵
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
    3⤵
    PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
    3⤵
    PID:6076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
    3⤵
    PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49782.exe
    3⤵
    PID:7556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
  2⤵
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
  2⤵
  PID:3908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
  2⤵
  PID:3508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7210.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7210.exe
  2⤵
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19132.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19132.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7096.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7096.exe
  2⤵
  PID:6168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
  2⤵
  PID:6932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-29682.exe

Filesize
468KB

MD5
1e7e5698be3aca047c9d35f4af0826d3

SHA1
044ab953afb4686efceaafcc4d090b355addd1fd

SHA256
353a63d275c925e54e5d8a86d08c6fe9d642fc2694f1f1fc858af1400470db7c

SHA512
18506b0eae2d88a1dc355d5e3e15b68bcf445b4368b56e83512c92e6014cf41a272a7838e3d3e48f4cc1ba283e12878f13f9157d6e56574658bb4c1c4bbf88fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe

Filesize
468KB

MD5
f9abdef8681b2181f9834374d5ea4bcc

SHA1
729c2ee643df903201bac28490ec452b9f4424d3

SHA256
42bc62ccd1e62595474fd06b93ca9d4433b434d3d4a3f3797342634c075c9336

SHA512
3445523b5e103bdc5853c6aef6191e8a2732f374cd9265ab715aab027b63a5b505775eff0dba40005335044f5c33bfea3a96230c7229be79be61276be73e13e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38039.exe

Filesize
468KB

MD5
553fcb487e4b3ac21a28e97ae4a98da9

SHA1
ce9b24799fa8b8a9b491aa9ad6e6bc450d48c1d2

SHA256
faa3a9c605520e82d9fd4e76d60d440d4cbe04719d6d431ba9b8413248278516

SHA512
b5a76e7f8be8937273df59dbafdc0ae41201f701b3571700f6607ad4b2e11d60108f7a7261aee650159258be6912348172e0d5851e1031f0249ad16618832265

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe

Filesize
468KB

MD5
f30d23766feb99c61ddf3c077ed605f4

SHA1
eae31d9ae95f9db5eae49fb59394424b0fd9c3a6

SHA256
190feec12c8d72d9c2ff211574eafe00708ecbef35bc0dcf675fe6778230e493

SHA512
3461741c255988f3c1147ed818a09fd67d741a0997b2e7b315c157ddb54f8bb404f16a68b87c0df90ec504313eea45b71b27c897323a9844191fdb96de07e096

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5662.exe

Filesize
468KB

MD5
24878eea38044391af288fd7676aa4f8

SHA1
dabe976ebfa2c9a75fb86806a711f7553af6b902

SHA256
5b96628b1ac58886d17e86d06ffd25c3c039756afef61d46d0c5c883c8c1c796

SHA512
55e47cd928a7ec16ff74efda7c9b2b8598a918c3d8ff8b37ed374365dca5d6ea5feb051e766183a0ff55622cedc190dd4e9cfc34c455350ce7a93b799fefe259

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5937.exe

Filesize
468KB

MD5
0cfc53215433847d0698811f8d68f116

SHA1
4c5e90d111cbda8b26865dd5a5fd998344757e45

SHA256
4c91ad373d6f5dff0405a05c00779949bf3984728695cf79fd90de0dd654e4fb

SHA512
439d4031fbf3bae38695390b67d06c3ef6e173652c0e3bfd14b647962cc035b79e089bf4e8d82cca53141c88312e19563303f4c1d24119cabe0d43b3af319fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe

Filesize
468KB

MD5
27910f21762ac31124693531d82b762c

SHA1
4ba04a8c874fc5caf93041c1406cff6c830d0f15

SHA256
a71de915639e0c94ccf27c56b7ee76ee0f4e703c0f5e10aaf955d602cc90d76a

SHA512
206c85e2f96dbe40fee0d1feb1a257b961b6c5e52ab2782441b2b18c2b775c29eca015c56d0a9e5356fd2a79b1eb3fd1818163204078eeba2f4bb485e8ad86e1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe

Filesize
468KB

MD5
4f6f19c1c8585f6003d3c794ebf8da52

SHA1
8576f5af545936b0c3420dc7b3f68db31c20b13b

SHA256
27fd81b806758763258689fc9899b2e243fd732d40bb658e783a9e2da2fe1d6d

SHA512
5c4e0db14873dfd7055e610613a54e3cbb92d7cca74f7e925a03eba1a324d9a620b9113d1fb596139a3b34ae8365ffb6207896df7a7558c08f76a33c4217c79e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23732.exe

Filesize
468KB

MD5
f75bae06a6e33b64fb8bfc9262ddeda7

SHA1
6864dd528939f4495c8e568b87e59ddae10e42f3

SHA256
4eb4646ba0f2adf3e6a2f1723fa24f2912e9e636cfed41cbcafef6154791ff4d

SHA512
ef30d27a47c6358ecb0901b665fe8652b8a2f9167ade06dc65db07f4027148d6c94b9ef1d58119c6bc31cd9895ce28e8706368228e19e687d0d80ede5568c78e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe

Filesize
468KB

MD5
61ee1d042c093928b7e6e2dfd081f67f

SHA1
1daf3e0b88d28ed899218b72202191c30910dec1

SHA256
53b0435e031060859c8f787630244fe992246eb26c80eb66d8859c3dd2599b40

SHA512
258fb4ee5be0be3a9da0cb56021aaac407ef82592afee1472d3cfb7b5ef1bd86cb3559a0e5b633d533a8b75c5d803273a0bf639d9eb4a922832a77696cdd6c81

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41495.exe

Filesize
468KB

MD5
1fa58a4e5bc29eaeddcbb4acedda859b

SHA1
72e66eec508c631798764ed8f0d378adac379efc

SHA256
db8b73e2d2c32136e221a6990214b45ce30a88bd8d1ed3c825f92a750c81b862

SHA512
f6d7ff0697893fba51c486e2fc2e9fa243dbab441bb5ae5504bc942c94cc653b00376ee670aabea5eaed75d6d88ec799a730b9c2e9ffec185d66fb2811fae55c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46015.exe

Filesize
468KB

MD5
a633055a68648ade3c7c54a520e9344e

SHA1
abd7aa138c17be69c4358a22839931c4ef2c2bd8

SHA256
486ac12db66de4c2245a2296c1c41bb00482f6a18a48b6f3bf60971b12f312da

SHA512
fc6bf8cf7ff31bd969bf6401dc04334777415b6ab2b40f3f361d2c1eafb8bacbe2077d8c14ecae8b979248f9c46fc2446ce3008fb64ea3f9136f265c8de115f1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe

Filesize
468KB

MD5
1637074508cc2b4b1cb4b1c969d91c21

SHA1
853c7bc147eb6d8dcb64d87c0d4bd1702c2e83d1

SHA256
853e7117a3b7a9d5d023c560b64b1e1ea9ae5fd5f7dce690883ebe32bb9d8a22

SHA512
845bbe7dbba72c708697c1a971259f4eea40fdcdc7306de9405a9813639a9be0429dd316d2c8e516246c0cf3f4908a141e082c454a62abda42b4b15490aa923f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58843.exe

Filesize
468KB

MD5
b707a82ceb37451fc5eb8a3dfa13437b

SHA1
f23f2519c765f14bb253dab02da418751cd9855e

SHA256
6cc4c52aeed731662b4391c51d33a95a50023a88f2af9d212965ae463e61382b

SHA512
cc45b3e590e8388d527ceb47de4d0ee87be6cc6d92c668f51c0c0a4a618e79b9d41b268e61db0825170afab6677d1698c31eb603ca8a95c0fd65ae75c65b6ffb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62626.exe

Filesize
468KB

MD5
774230c501cc570179b68304c2b375e5

SHA1
f9301ec3080836c2d8d69e2faef4a1faa70844be

SHA256
91033c677222dbb49fecfa1c6966304d5160caadb1363c4e5e9abda5b04c9c18

SHA512
5ac8f315382e4e0811b140b941ed5bab323eee02ec2571ba20244e605d24c235a574bb7fa281cebcf9e890a9d7ef4fcf614ea602bbce8d2158a54c7f1f0e02ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe

Filesize
468KB

MD5
c59a25392641066ec6a3455ff56b65eb

SHA1
6c14416f9f8f57e6d073a9a8fe8ade4b47aa82fe

SHA256
85d942adedfca224300fb730c8ca8798f61099feda716e5528832d5d15407049

SHA512
592d01d16bf68eb9efd93f94e7299d8410b64f42c7a739d55f86266628ec38af4c47e118dfdf5683d307a152705d592694e06dd21178fbfe85ca0359913093fe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe

Filesize
468KB

MD5
b31329a5002f916632246f23cd380594

SHA1
7632239ab80446ca9e4779753ddb8903b308562f

SHA256
d73dbfb80bf72b9a95bbf47f3bb53c4442b97855e835bff05b306779b16894e6

SHA512
3f66d7a7bc0fc722a6bbce7ff2be0135d4f6f16b3f24e56b917c2de25aba77078f386af16c3651abe9f926c4d4800e4f1b20e51d50400447bcb2fe58068e1d3f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe

Filesize
468KB

MD5
61f1937ea803739c92197c9bc57e5023

SHA1
f22cbe23fe428ab95cb284d060bcd196cb06da25

SHA256
8cc5729bce1daadbe3451925b4fe034d84548c6c05a239b7e8b88db493947ee4

SHA512
2c6f19ecd86cdcca02fb9b3971491f97912c2a2cfcaea7147e1180693e0f3cdb99eb5cea50870913323aabcfed9928a4c2b5e10719682d146d5e793829e36ab5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe

Filesize
468KB

MD5
f5b287163bafb7e120b345ccc0951d2f

SHA1
f15da1081646b15a088c2307d7e1871a5da3c114

SHA256
71ae159a941c525b96a5b7eeb8d77903d666b89f642ce21ba78b8d93e694ad88

SHA512
16681702d34246b19f367412db17def6f479e2d996ca7bf44b0db3b1e74c164d8e86ea30557d1d7d1e7c065347803e00b49e798ef58bf27fa47871fd939cf126

Download Submit