cf09b1d6bfff5b9e534b4714f72b12988961b2068e66fe81a54bb69bb2194f39

Analysis

max time kernel
120s
max time network
14s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3c7a9292665b07d08f49554158e5290N.exe
Size

468KB
MD5

c3c7a9292665b07d08f49554158e5290
SHA1

874ce326bdd393b874048709f17d14c0fa47b05f
SHA256

cf09b1d6bfff5b9e534b4714f72b12988961b2068e66fe81a54bb69bb2194f39
SHA512

57dbc0e2936c3e2bb561adc984aa53a5dd738f4edc6912b08880ab0f42f74b4f1550e07d839214216fe4700cafc6e16b4705ae15dd9af1f8d5198fbdb1b8ab4a
SSDEEP

3072:/bCBovIwU35/tbY4Pgt58fF/E5Ra6IXXlmHowrBaJkgwwfRueol9:/bIoIJ/tjPM58fU2JRJk9uRue

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2308	Unicorn-56838.exe
2768	Unicorn-37055.exe
2864	Unicorn-22111.exe
2800	Unicorn-57004.exe
2828	Unicorn-54958.exe
2812	Unicorn-45307.exe
1312	Unicorn-61088.exe
2652	Unicorn-56078.exe
1548	Unicorn-14780.exe
2336	Unicorn-53940.exe
2012	Unicorn-26019.exe
2000	Unicorn-12284.exe
2032	Unicorn-32150.exe
1988	Unicorn-47095.exe
2972	Unicorn-52077.exe
2992	Unicorn-36295.exe
2160	Unicorn-21905.exe
1232	Unicorn-19981.exe
444	Unicorn-51891.exe
1072	Unicorn-7536.exe
900	Unicorn-46166.exe
1080	Unicorn-15705.exe
1900	Unicorn-56637.exe
1896	Unicorn-62767.exe
1436	Unicorn-5398.exe
2256	Unicorn-16259.exe
2556	Unicorn-11520.exe
1012	Unicorn-63322.exe
1892	Unicorn-56244.exe
1004	Unicorn-15002.exe
2524	Unicorn-21133.exe
2420	Unicorn-35008.exe
1604	Unicorn-28232.exe
2064	Unicorn-65080.exe
3020	Unicorn-5673.exe
2184	Unicorn-63597.exe
2728	Unicorn-52736.exe
2792	Unicorn-4712.exe
2856	Unicorn-14396.exe
2324	Unicorn-42430.exe
2696	Unicorn-34816.exe
2584	Unicorn-23956.exe
2704	Unicorn-35445.exe
1608	Unicorn-48460.exe
1552	Unicorn-45699.exe
2816	Unicorn-27.exe
1040	Unicorn-27.exe
2640	Unicorn-49128.exe
2668	Unicorn-35392.exe
2936	Unicorn-24532.exe
1688	Unicorn-34737.exe
2612	Unicorn-40868.exe
2108	Unicorn-22394.exe
2396	Unicorn-22128.exe
1496	Unicorn-65372.exe
1108	Unicorn-22948.exe
2960	Unicorn-46633.exe
1288	Unicorn-30754.exe
3012	Unicorn-27992.exe
1912	Unicorn-25300.exe
1440	Unicorn-6560.exe
1696	Unicorn-41636.exe
2332	Unicorn-23162.exe
1192	Unicorn-50359.exe

Loads dropped DLL 64 IoCs

pid	Process
2152	c3c7a9292665b07d08f49554158e5290N.exe
2152	c3c7a9292665b07d08f49554158e5290N.exe
2308	Unicorn-56838.exe
2152	c3c7a9292665b07d08f49554158e5290N.exe
2308	Unicorn-56838.exe
2152	c3c7a9292665b07d08f49554158e5290N.exe
2768	Unicorn-37055.exe
2768	Unicorn-37055.exe
2152	c3c7a9292665b07d08f49554158e5290N.exe
2152	c3c7a9292665b07d08f49554158e5290N.exe
2864	Unicorn-22111.exe
2308	Unicorn-56838.exe
2308	Unicorn-56838.exe
2864	Unicorn-22111.exe
2828	Unicorn-54958.exe
2828	Unicorn-54958.exe
2152	c3c7a9292665b07d08f49554158e5290N.exe
2152	c3c7a9292665b07d08f49554158e5290N.exe
1312	Unicorn-61088.exe
1312	Unicorn-61088.exe
2308	Unicorn-56838.exe
2864	Unicorn-22111.exe
2308	Unicorn-56838.exe
2800	Unicorn-57004.exe
2864	Unicorn-22111.exe
2768	Unicorn-37055.exe
2768	Unicorn-37055.exe
2800	Unicorn-57004.exe
2652	Unicorn-56078.exe
2652	Unicorn-56078.exe
2828	Unicorn-54958.exe
2828	Unicorn-54958.exe
2812	Unicorn-45307.exe
2812	Unicorn-45307.exe
1548	Unicorn-14780.exe
1548	Unicorn-14780.exe
2152	c3c7a9292665b07d08f49554158e5290N.exe
2152	c3c7a9292665b07d08f49554158e5290N.exe
2012	Unicorn-26019.exe
2012	Unicorn-26019.exe
2308	Unicorn-56838.exe
2308	Unicorn-56838.exe
1988	Unicorn-47095.exe
1988	Unicorn-47095.exe
2768	Unicorn-37055.exe
2768	Unicorn-37055.exe
2000	Unicorn-12284.exe
2000	Unicorn-12284.exe
2032	Unicorn-32150.exe
2032	Unicorn-32150.exe
1312	Unicorn-61088.exe
1312	Unicorn-61088.exe
2864	Unicorn-22111.exe
2864	Unicorn-22111.exe
2800	Unicorn-57004.exe
2800	Unicorn-57004.exe
2992	Unicorn-36295.exe
2992	Unicorn-36295.exe
2972	Unicorn-52077.exe
2828	Unicorn-54958.exe
2828	Unicorn-54958.exe
2972	Unicorn-52077.exe
2652	Unicorn-56078.exe
2652	Unicorn-56078.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3612	2216	WerFault.exe	126

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11797.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2152	c3c7a9292665b07d08f49554158e5290N.exe
2308	Unicorn-56838.exe
2768	Unicorn-37055.exe
2864	Unicorn-22111.exe
2828	Unicorn-54958.exe
1312	Unicorn-61088.exe
2800	Unicorn-57004.exe
2812	Unicorn-45307.exe
2652	Unicorn-56078.exe
1548	Unicorn-14780.exe
2336	Unicorn-53940.exe
2012	Unicorn-26019.exe
2032	Unicorn-32150.exe
2000	Unicorn-12284.exe
1988	Unicorn-47095.exe
2992	Unicorn-36295.exe
2972	Unicorn-52077.exe
2160	Unicorn-21905.exe
1232	Unicorn-19981.exe
444	Unicorn-51891.exe
1072	Unicorn-7536.exe
900	Unicorn-46166.exe
1080	Unicorn-15705.exe
1900	Unicorn-56637.exe
1896	Unicorn-62767.exe
1436	Unicorn-5398.exe
2256	Unicorn-16259.exe
1012	Unicorn-63322.exe
2556	Unicorn-11520.exe
1892	Unicorn-56244.exe
1004	Unicorn-15002.exe
2524	Unicorn-21133.exe
2420	Unicorn-35008.exe
1604	Unicorn-28232.exe
3020	Unicorn-5673.exe
2064	Unicorn-65080.exe
2184	Unicorn-63597.exe
2728	Unicorn-52736.exe
2792	Unicorn-4712.exe
2856	Unicorn-14396.exe
2324	Unicorn-42430.exe
2696	Unicorn-34816.exe
2584	Unicorn-23956.exe
2704	Unicorn-35445.exe
1608	Unicorn-48460.exe
2816	Unicorn-27.exe
1552	Unicorn-45699.exe
1040	Unicorn-27.exe
2668	Unicorn-35392.exe
2640	Unicorn-49128.exe
2936	Unicorn-24532.exe
1688	Unicorn-34737.exe
2612	Unicorn-40868.exe
2108	Unicorn-22394.exe
2396	Unicorn-22128.exe
1496	Unicorn-65372.exe
1108	Unicorn-22948.exe
2960	Unicorn-46633.exe
1288	Unicorn-30754.exe
3012	Unicorn-27992.exe
1912	Unicorn-25300.exe
1440	Unicorn-6560.exe
1696	Unicorn-41636.exe
2332	Unicorn-23162.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2308	2152	c3c7a9292665b07d08f49554158e5290N.exe	30
PID 2152 wrote to memory of 2308	2152	c3c7a9292665b07d08f49554158e5290N.exe	30
PID 2152 wrote to memory of 2308	2152	c3c7a9292665b07d08f49554158e5290N.exe	30
PID 2152 wrote to memory of 2308	2152	c3c7a9292665b07d08f49554158e5290N.exe	30
PID 2308 wrote to memory of 2864	2308	Unicorn-56838.exe	32
PID 2308 wrote to memory of 2864	2308	Unicorn-56838.exe	32
PID 2308 wrote to memory of 2864	2308	Unicorn-56838.exe	32
PID 2308 wrote to memory of 2864	2308	Unicorn-56838.exe	32
PID 2152 wrote to memory of 2768	2152	c3c7a9292665b07d08f49554158e5290N.exe	33
PID 2152 wrote to memory of 2768	2152	c3c7a9292665b07d08f49554158e5290N.exe	33
PID 2152 wrote to memory of 2768	2152	c3c7a9292665b07d08f49554158e5290N.exe	33
PID 2152 wrote to memory of 2768	2152	c3c7a9292665b07d08f49554158e5290N.exe	33
PID 2768 wrote to memory of 2800	2768	Unicorn-37055.exe	34
PID 2768 wrote to memory of 2800	2768	Unicorn-37055.exe	34
PID 2768 wrote to memory of 2800	2768	Unicorn-37055.exe	34
PID 2768 wrote to memory of 2800	2768	Unicorn-37055.exe	34
PID 2152 wrote to memory of 2828	2152	c3c7a9292665b07d08f49554158e5290N.exe	35
PID 2152 wrote to memory of 2828	2152	c3c7a9292665b07d08f49554158e5290N.exe	35
PID 2152 wrote to memory of 2828	2152	c3c7a9292665b07d08f49554158e5290N.exe	35
PID 2152 wrote to memory of 2828	2152	c3c7a9292665b07d08f49554158e5290N.exe	35
PID 2308 wrote to memory of 2812	2308	Unicorn-56838.exe	37
PID 2308 wrote to memory of 2812	2308	Unicorn-56838.exe	37
PID 2308 wrote to memory of 2812	2308	Unicorn-56838.exe	37
PID 2308 wrote to memory of 2812	2308	Unicorn-56838.exe	37
PID 2864 wrote to memory of 1312	2864	Unicorn-22111.exe	36
PID 2864 wrote to memory of 1312	2864	Unicorn-22111.exe	36
PID 2864 wrote to memory of 1312	2864	Unicorn-22111.exe	36
PID 2864 wrote to memory of 1312	2864	Unicorn-22111.exe	36
PID 2828 wrote to memory of 2652	2828	Unicorn-54958.exe	38
PID 2828 wrote to memory of 2652	2828	Unicorn-54958.exe	38
PID 2828 wrote to memory of 2652	2828	Unicorn-54958.exe	38
PID 2828 wrote to memory of 2652	2828	Unicorn-54958.exe	38
PID 2152 wrote to memory of 1548	2152	c3c7a9292665b07d08f49554158e5290N.exe	39
PID 2152 wrote to memory of 1548	2152	c3c7a9292665b07d08f49554158e5290N.exe	39
PID 2152 wrote to memory of 1548	2152	c3c7a9292665b07d08f49554158e5290N.exe	39
PID 2152 wrote to memory of 1548	2152	c3c7a9292665b07d08f49554158e5290N.exe	39
PID 1312 wrote to memory of 2336	1312	Unicorn-61088.exe	40
PID 1312 wrote to memory of 2336	1312	Unicorn-61088.exe	40
PID 1312 wrote to memory of 2336	1312	Unicorn-61088.exe	40
PID 1312 wrote to memory of 2336	1312	Unicorn-61088.exe	40
PID 2308 wrote to memory of 2012	2308	Unicorn-56838.exe	41
PID 2308 wrote to memory of 2012	2308	Unicorn-56838.exe	41
PID 2308 wrote to memory of 2012	2308	Unicorn-56838.exe	41
PID 2308 wrote to memory of 2012	2308	Unicorn-56838.exe	41
PID 2864 wrote to memory of 2000	2864	Unicorn-22111.exe	42
PID 2864 wrote to memory of 2000	2864	Unicorn-22111.exe	42
PID 2864 wrote to memory of 2000	2864	Unicorn-22111.exe	42
PID 2864 wrote to memory of 2000	2864	Unicorn-22111.exe	42
PID 2768 wrote to memory of 1988	2768	Unicorn-37055.exe	44
PID 2768 wrote to memory of 1988	2768	Unicorn-37055.exe	44
PID 2768 wrote to memory of 1988	2768	Unicorn-37055.exe	44
PID 2768 wrote to memory of 1988	2768	Unicorn-37055.exe	44
PID 2800 wrote to memory of 2032	2800	Unicorn-57004.exe	43
PID 2800 wrote to memory of 2032	2800	Unicorn-57004.exe	43
PID 2800 wrote to memory of 2032	2800	Unicorn-57004.exe	43
PID 2800 wrote to memory of 2032	2800	Unicorn-57004.exe	43
PID 2652 wrote to memory of 2972	2652	Unicorn-56078.exe	45
PID 2652 wrote to memory of 2972	2652	Unicorn-56078.exe	45
PID 2652 wrote to memory of 2972	2652	Unicorn-56078.exe	45
PID 2652 wrote to memory of 2972	2652	Unicorn-56078.exe	45
PID 2828 wrote to memory of 2992	2828	Unicorn-54958.exe	46
PID 2828 wrote to memory of 2992	2828	Unicorn-54958.exe	46
PID 2828 wrote to memory of 2992	2828	Unicorn-54958.exe	46
PID 2828 wrote to memory of 2992	2828	Unicorn-54958.exe	46

C:\Users\Admin\AppData\Local\Temp\c3c7a9292665b07d08f49554158e5290N.exe
"C:\Users\Admin\AppData\Local\Temp\c3c7a9292665b07d08f49554158e5290N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16831.exe
        7⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20360.exe
        8⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11797.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        8⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        8⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        7⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21096.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        6⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        7⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        8⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        8⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        8⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        7⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        6⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52265.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55255.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58088.exe
        6⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57671.exe
        7⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14521.exe
        8⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        8⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        8⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        7⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        7⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
        6⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        7⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        7⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56415.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42273.exe
        6⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7860.exe
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
        6⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe
        7⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64703.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
        8⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
        7⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40348.exe
        6⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57661.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36410.exe
        5⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64003.exe
        5⤵
        
        PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10138.exe
        5⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51866.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62767.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48460.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
        7⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        8⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        8⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        7⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        7⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
        6⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19976.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24727.exe
        6⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63607.exe
        7⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26561.exe
        6⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36046.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        7⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        6⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21179.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23977.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        7⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        6⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16119.exe
        5⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60567.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        6⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42104.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59051.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51171.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        5⤵
        
        PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11520.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        6⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        7⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30321.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        6⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
        5⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exe
        6⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
        5⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        6⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        5⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        6⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24968.exe
      4⤵
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49688.exe
      4⤵
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60366.exe
      4⤵
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
      4⤵
      PID:6720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45307.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28232.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        7⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        8⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23659.exe
        7⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
        6⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exe
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40725.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48221.exe
        5⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe
        6⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        7⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        6⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34122.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        6⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34105.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        5⤵
        
        PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        5⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        6⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26798.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        6⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14173.exe
        5⤵
        
        PID:324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        5⤵
        
        PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62798.exe
      4⤵
      PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
      4⤵
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        5⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exe
        5⤵
        
        PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15250.exe
      4⤵
      PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34279.exe
      4⤵
      PID:7048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42430.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
        6⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41714.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        7⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
        6⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54359.exe
        5⤵
        
        PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        5⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13395.exe
        6⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50880.exe
        6⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49778.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6415.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        5⤵
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42112.exe
      4⤵
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        5⤵
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        5⤵
        
        PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29690.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exe
      4⤵
      PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
      4⤵
      PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23956.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16831.exe
        5⤵
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
        6⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exe
        5⤵
        
        PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22200.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
        5⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37805.exe
      4⤵
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30872.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35445.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
      4⤵
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33924.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
        5⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
      4⤵
      PID:6880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
    3⤵
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10462.exe
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
      4⤵
      PID:6972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
    3⤵
    PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24305.exe
    3⤵
    PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56954.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37055.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37055.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32150.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36644.exe
        8⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        8⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42076.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        7⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        7⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19534.exe
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        7⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
        6⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18330.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        6⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        6⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15983.exe
        5⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4018.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17396.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        6⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61122.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64832.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63322.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
        6⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
        7⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        6⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23136.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58809.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        5⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53934.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18588.exe
        5⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37983.exe
        5⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55289.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        5⤵
        
        PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62798.exe
      4⤵
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        5⤵
        
        PID:484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
      4⤵
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44940.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17045.exe
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
      4⤵
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe
        7⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
        7⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41329.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53779.exe
        5⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
        6⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18766.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50501.exe
        5⤵
        
        PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22948.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        5⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        6⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62554.exe
        5⤵
        
        PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50214.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        5⤵
        
        PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44210.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
      4⤵
      PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5914.exe
      4⤵
      PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56637.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        5⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        6⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39051.exe
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47422.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63234.exe
      4⤵
      PID:2216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 240
        5⤵
        Program crash
        
        PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30232.exe
      4⤵
      PID:7080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32228.exe
      4⤵
      PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13037.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        5⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        5⤵
        
        PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
      4⤵
      PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25996.exe
      4⤵
      PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
    3⤵
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
      4⤵
      PID:6496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
    3⤵
    PID:3344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
    3⤵
    PID:6724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54958.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54958.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56078.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59337.exe
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        7⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
        6⤵
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10499.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        5⤵
        Executes dropped EXE
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21494.exe
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35008.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15351.exe
        5⤵
        
        PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
      4⤵
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33540.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        5⤵
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      4⤵
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30754.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        6⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        6⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1225.exe
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50641.exe
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23659.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        5⤵
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        5⤵
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
      4⤵
      PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31090.exe
      4⤵
      PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
      4⤵
      PID:6600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25300.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39960.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52399.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        6⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12849.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
      4⤵
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6560.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe
      4⤵
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exe
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15061.exe
        5⤵
        
        PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      4⤵
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
      4⤵
      PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
      4⤵
      PID:7288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10130.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57310.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
    3⤵
    PID:6164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14780.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14780.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
        5⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
        6⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        6⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59099.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53934.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
      4⤵
      PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13545.exe
      4⤵
      PID:6308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53779.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
        5⤵
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16119.exe
      4⤵
      PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
      4⤵
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
      4⤵
      PID:6544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63985.exe
    3⤵
    PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28336.exe
      4⤵
      PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2627.exe
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
      4⤵
      PID:6168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
    3⤵
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52457.exe
    3⤵
    PID:3168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18018.exe
    3⤵
    PID:4444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
    3⤵
    PID:6688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52736.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
      4⤵
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18630.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50641.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
      4⤵
      PID:6932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
    3⤵
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
      4⤵
      PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
      4⤵
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5881.exe
      4⤵
      PID:6272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
    3⤵
    PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
    3⤵
    PID:4612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
    3⤵
    PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4712.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4712.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2549.exe
    3⤵
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
      4⤵
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        5⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        5⤵
        
        PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
      4⤵
      PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
      4⤵
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
      4⤵
      PID:7176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
    3⤵
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe
      4⤵
      PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe
    3⤵
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe
    3⤵
    PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63962.exe
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54386.exe
    3⤵
    PID:6424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
  2⤵
  PID:1668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
    3⤵
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55720.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
    3⤵
    PID:6200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
    3⤵
    PID:6556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
  2⤵
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16453.exe
    3⤵
    PID:6460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-330.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-330.exe
  2⤵
  PID:3564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34644.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34644.exe
  2⤵
  PID:5968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45746.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45746.exe
  2⤵
  PID:6276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe

Filesize
468KB

MD5
773513337f4826ab1b5460a2064ee2e5

SHA1
c0043ef2e2ccce146d11e88ce35d7b8b0a52b202

SHA256
759032522287b635466748fa5314b3dd70d728baa711f53c2ee1ad9a161e07aa

SHA512
7eabee2b1e76a2fac9c2500b0f9e8429399428a0c605b65e5c7e040063a0829fa0db70a96c5ca4e73717f7bd3687b5cae34b9ed99ed12f5528bb6b6050eaa7c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe

Filesize
468KB

MD5
d68680c01cac2ad2bf2f967d9e29105b

SHA1
c8c320da1c9f5ac90dc620cdc62dd26b20fffb1f

SHA256
d9273763d4024561cf3994453b05d4dede8c0bc7e315e1839dae3ce25fc10a9a

SHA512
51a767ea0a212925ec772f15f9dda032a23f2f7a482409fe488f39a0c90ea085ce7e8dddd9cbb1f26ffb1d93e6f339e048290d9ea79ebcad23a774c3a32d3848

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe

Filesize
468KB

MD5
642722a09ac978453ca7c5799fb7f7a2

SHA1
f8789438590af4a05785c23fb7d1696060e91f77

SHA256
f4953909ed651c000aedef6c1f564d86fdecffccd9917af4e7bd0280f31b2521

SHA512
cf0d02f3cf50f508830b61f58917f82a87c18d14fcab0caf1fbac0f1040a3d4b0904a55395c03d5d7e23e5a1cf671d0c03511b34affe24151f47f69e65586641

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe

Filesize
468KB

MD5
048b547c7979001b904365d116de93ce

SHA1
d25d3e51da005ff5bc56cec6fa25aff5918d309c

SHA256
96898bb2106d0ef676286f64806e7b28a6bf448d1bef7922781c9c07fbe13768

SHA512
01a1f7f272120f3c40eeabefa42e3c850a28bcf08eeca314b524a792b80d0fcbc2b15a80136efe3272a03c6211e4710dec722ae7a63513951c6fd98c2e304e4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe

Filesize
468KB

MD5
e4622ecbf79c651e81b7e6b06549e6b9

SHA1
6ba7becfeba44d7ecd9d3e1af51b166d020e79f1

SHA256
167ef28c23ba8b486047ad3fa38d19f8d71c1806b2c79fa8496f7aa59152d670

SHA512
9868de88bca8913f7920ed7fc38f5b302c69d03225010b11a0ab46ebe0413248e079380330dae9ab96516d8d1b8060b599fb12f78417cec2195abde7bc773ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36644.exe

Filesize
468KB

MD5
448cc5e820b7d2c2a7b67a95d93d608b

SHA1
fb3df9c32bcde6aea51e89a739310ca84ab77462

SHA256
5e98b681985bf56b58254f695273194771176326d4347026094e6271a3b8475e

SHA512
a68d985af0d777b930977dd6c7abceca906cb4cf3b7f306dd2cbc8bc994ba68a33cee7a9c99ed16019f13c198903518294c3356bfb89659619dbcafd4e7d9274

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe

Filesize
468KB

MD5
4de338c27aef1b6ae7f5b431044b8c9c

SHA1
768a58a069cc59d0a2bad50a4c6752adc05dc8ff

SHA256
2be5a85af4c362a86dea98d4ba083aadb8d585e3e5414468af090d8cc03346e8

SHA512
5ecde81d50d2909c6191c47d57105fce4375cd92ea001457be0bbd9a5ae37cd3965fe4d46fda78e1b378ef14d4dc3739fb4ebdebfcfd5ad78f28b9f5a54dc01a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54958.exe

Filesize
468KB

MD5
84ae35c34faded420b96843abcaae887

SHA1
2d9f38b244c86e47317508cfc641616b9e507169

SHA256
c60bd9666fdd09864e8f78f88db2b4f02ae1f6c3802a8ea181e422276b140e76

SHA512
b167646ef7993a0982ef957c0344feb501c244d988ea1249958c26288159b90e7a0caeff5e2acffcd10134ca9ab8dc31785d34b8f4b25253664aef79fbb0aea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe

Filesize
468KB

MD5
bf095ba185498ae914670e65795b6b7a

SHA1
d18f54a7061947b9c3875f8b07831b002884df99

SHA256
dc1256c88a49a47d0fd3af78479aa8df979ddcadf248a1225b146950c6065cb2

SHA512
3f8a1e0c2967fee669e426fd587f49b5d3bdf1d399be98cd00a4c72250cc6e87feec7fbfda86c24d658944ee65616a7525088d54bebab58d464fe779166667bd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14780.exe

Filesize
468KB

MD5
de47b00f4ed4b57c6e6aed877fb900e6

SHA1
39842b7aa46656798856e0423962f3596db8883a

SHA256
163e96ff45e2bb89f1a64533b6deca6be8a5a83507064d88540e9b1d7ea9763d

SHA512
2a72f467ce69959b2583b56a951d9133827c935892bf2eec4b936b092cb0d49e0877d416c622d17bc9c10aa29a7f90f4d2cfab4bfdd4efb0a9ef550572d99e9e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe

Filesize
468KB

MD5
754fd3c577675b5c2b115a815ecf0d01

SHA1
3a6a199fb66784cb96388787d37e647c3f93615a

SHA256
5a98fd3ec5f9bb9417b9281833a206ffe1cdc898b0d2d28af6f93f892b127344

SHA512
6fa91e82f90022b5e68ace812b11af049f9ab64821bedc38c3c7b9c8fa7c437c0ab930240e2be5d75e4e2f1764022f31655604af3ff98c8e13aad4adef28fe60

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe

Filesize
468KB

MD5
c323db82b202c8ed86fe9f3d57c11f3c

SHA1
8214ab3afa1c727ac2f0859e01c436f178479195

SHA256
e052cb56ba437607134832e0e784ee3910ad7a9e125037d1147f922c8782dee2

SHA512
72c47ccaef0a003e46988b224f609b9f179a7de7fcb300c1fd31e495eca730e5720ad381b9bc639043955917a3d0d2838faf4edb86f3a5e1563e495b79c32e40

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32150.exe

Filesize
468KB

MD5
0c879a132b9b69ea4e875d584286fed2

SHA1
09a151a1bf6fcc30fdc17ead94c79a2bd53b6a1f

SHA256
d7e8bd2e8dcfb861000fa57e9df0b63b27afa2c58ef47971cb2c534de4f60a93

SHA512
1916672d5d3327a4bf4932a5ccb6c9da893addef3cab3ea3f73d7f859fae5d0c3509acd02719a3058d6702a893b131b189e59533d5949b89569eb6212adbceae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe

Filesize
468KB

MD5
12c46aae474972ee39ecb19d5d7f3ee3

SHA1
64bc8334a474f77c34ebb6e8a0753bfb035480be

SHA256
ce311b3536a90e3f00c9597e09739e5a7a229df591afcc9c491295f2f34d3291

SHA512
3f518d8eb0503e3b500b461d3239e5db5c501a74c3a360eb031884ac42f862246bce8ba1897cf2422d4b7e9140c15e6000be593501f38905f9296781f02fb9e5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37055.exe

Filesize
468KB

MD5
c110bbdb634a89c87ca44a9839811d2b

SHA1
b6f003aebe2dc5e123a46b4c4c4f3e20d2ce25fd

SHA256
5d04021aa59b2c57dd49442867ca9dc389fe311b2d8dff5bd6d02bdc5a53f709

SHA512
0b9a574c3e1d608dc3feda942a31c4c0d73a02397fee652ce8a3e9044b7117453f2415586985ca49c7ad8b53959f4ac41d40d9b3736099224f3a7da079bceaf2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45307.exe

Filesize
468KB

MD5
1e59c4b924614faffe356edd3a5c3529

SHA1
f2e19375ac33b6a36a835f4a2790962aef7712a1

SHA256
b0569e0ef6821b9fceaf4d47af16019d4c892ee40c1c4e89b79ae57ea07ac456

SHA512
5a7cacfe38a031051006e65257a97004ddc435a71ab91ee01085eb2e5a5c318f793235fb4b748377ab74979d4548824bd3ed6e2b1d902c1f10003b482c372525

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe

Filesize
468KB

MD5
521c0975a8737395d12c3f1e14e4d94b

SHA1
53cbc0cb9b3d8d9c0bf11e57e188f3f282d03742

SHA256
a16186f84afe5249b5487ea1235541e6dc18d138ea815b50a354c8a3eed2a039

SHA512
b89bb30a589e756086b330ffd0bc2ad692d0068e13f1aac1a1a2cba7a443c8b12cdb500e0eb6dd6eb45b8a0e01f7449942af477b028b23a50262aaa6829ef590

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe

Filesize
468KB

MD5
b7f78b4d885d407a38b3f448a0cac266

SHA1
5714faaa112c73976571ffb7a94820fe5edb141f

SHA256
8723870b31b956458f38aed2ed83b1aa1a415712d0612b178feff7dc1aa6fd16

SHA512
70a095f16072c3459a83c9ad502f3ad477d86823711054467299c8ac551b2c144ee45b46d7c05388dbecd3d548ab4af224b73c1f6396ff7f1418aa7c77358a27

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56078.exe

Filesize
468KB

MD5
5b3e93db5bd02ceeea55c6d2f91eae7e

SHA1
9ed21859ea8d5a435950855e7473a133c605285e

SHA256
d455f6e17ae2eb0c9420f484b542dd6d2b499e1a38bb5b4712ecd6b5dcdd3550

SHA512
b77f78c6d656cf518f44cb6c9a6ee8c412dc9d4f4e2e296d2541c839061baca23c1edb50206a9d73c8c3abd1451c290f5907ed0b398fb4610c0a940869347205

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe

Filesize
468KB

MD5
fc0cdeba7fa1d0fcc267a1205f3bd255

SHA1
e505c762b5fa662db3633d67a5bde62995f65434

SHA256
b5d91eabf4f4bd6321eed98b1faba40611835a3b5736d140642369585bb9d804

SHA512
343b06ff04b852aade716e5089a917b44e122323b80e86163cca155fe55e6b557fd26f58b1e109d869d9cec993807c287790247c60840150348f3e6fe6d0689d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe

Filesize
468KB

MD5
6e77ebb2587a8edfa547a6248b9d617c

SHA1
b534fa1d3246265c2a3ad8b31d3116ae50de4e16

SHA256
1514102d1334f32405bc5738ba6a6311444b81f61a550b80d8b484e98b18eecc

SHA512
a63fa76bd3bed7a57c03602bf2b3308af382ccfdd488f3a8953aeb391cf3686864f384edf04b9a380e2d9df096a1b5154a09d0de49ed0d774665cd7ecf19b049

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe

Filesize
468KB

MD5
3228b17325b9e0da20ff28e1c2e9142e

SHA1
a60cc2c6b42da12c1c8cb6a719badc8850179fba

SHA256
a0fe6dfdd3197cabc6ef1d71aa9017ccf74aa7c44b66c7790289ae0807c3a45c

SHA512
c526725454bc9340d5b3ad520b01ebe9d9e481fa9406309514fc3151d5d3d8726b95af56d036a9b83ce5c0356c67b4f83a20902819bc8949c5575b1d6f1d003f

Download Submit