8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c

Analysis

max time kernel
148s
max time network
118s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
Size

468KB
MD5

04e963074b98f0d32a8c872f44350b24
SHA1

9dc7df602b0e15e113e090b5173589211039eebd
SHA256

8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c
SHA512

f54e2b958e146784030cef4855adb8c45e8fb2d99e1bec21ed5b32b280d2c8ed57bee22a9fc1b28966e069f688f18851e60b281ce87425772e1ebe50c50badd6
SSDEEP

3072:4bOlogxaIU57tbYEPzrembfD/n2DmsIH9QmyeQVqew5Kkkh1uxulj:4bIoCc7t7Pfembfea7Ow5D81ux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1496	Unicorn-51509.exe
2164	Unicorn-44912.exe
2176	Unicorn-55581.exe
1704	Unicorn-59962.exe
2768	Unicorn-25409.exe
2436	Unicorn-18027.exe
2848	Unicorn-12634.exe
3020	Unicorn-61621.exe
2952	Unicorn-58777.exe
2692	Unicorn-15601.exe
2652	Unicorn-42275.exe
2216	Unicorn-23983.exe
2472	Unicorn-59561.exe
548	Unicorn-22098.exe
296	Unicorn-25968.exe
1844	Unicorn-34422.exe
1336	Unicorn-22937.exe
1248	Unicorn-62320.exe
2780	Unicorn-35786.exe
2996	Unicorn-8236.exe
1712	Unicorn-23949.exe
2020	Unicorn-26218.exe
840	Unicorn-28501.exe
1864	Unicorn-22635.exe
348	Unicorn-28766.exe
1232	Unicorn-48200.exe
1944	Unicorn-2528.exe
1852	Unicorn-34599.exe
2212	Unicorn-27064.exe
2484	Unicorn-29864.exe
1520	Unicorn-55131.exe
772	Unicorn-9459.exe
1964	Unicorn-9459.exe
1664	Unicorn-13682.exe
2172	Unicorn-13682.exe
2292	Unicorn-65484.exe
2252	Unicorn-65484.exe
2060	Unicorn-19813.exe
2264	Unicorn-19813.exe
2280	Unicorn-65484.exe
2412	Unicorn-19813.exe
2304	Unicorn-19813.exe
936	Unicorn-32837.exe
540	Unicorn-20389.exe
2720	Unicorn-28451.exe
2704	Unicorn-34582.exe
2824	Unicorn-34582.exe
2844	Unicorn-34582.exe
2712	Unicorn-16601.exe
2056	Unicorn-44675.exe
1796	Unicorn-62058.exe
2608	Unicorn-59168.exe
2860	Unicorn-4934.exe
1564	Unicorn-54675.exe
1932	Unicorn-15500.exe
1044	Unicorn-30721.exe
1588	Unicorn-22631.exe
2000	Unicorn-29241.exe
316	Unicorn-43848.exe
1288	Unicorn-23003.exe
2964	Unicorn-32903.exe
1792	Unicorn-49681.exe
2976	Unicorn-61866.exe
2992	Unicorn-61866.exe

Loads dropped DLL 64 IoCs

pid	Process
2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
1496	Unicorn-51509.exe
2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
1496	Unicorn-51509.exe
2176	Unicorn-55581.exe
2176	Unicorn-55581.exe
2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
2164	Unicorn-44912.exe
2164	Unicorn-44912.exe
1496	Unicorn-51509.exe
1496	Unicorn-51509.exe
1704	Unicorn-59962.exe
1704	Unicorn-59962.exe
2176	Unicorn-55581.exe
2176	Unicorn-55581.exe
2768	Unicorn-25409.exe
2768	Unicorn-25409.exe
2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
2436	Unicorn-18027.exe
2436	Unicorn-18027.exe
2164	Unicorn-44912.exe
2848	Unicorn-12634.exe
2164	Unicorn-44912.exe
2848	Unicorn-12634.exe
1496	Unicorn-51509.exe
1496	Unicorn-51509.exe
3020	Unicorn-61621.exe
3020	Unicorn-61621.exe
1704	Unicorn-59962.exe
1704	Unicorn-59962.exe
2692	Unicorn-15601.exe
2692	Unicorn-15601.exe
2768	Unicorn-25409.exe
2768	Unicorn-25409.exe
2216	Unicorn-23983.exe
2216	Unicorn-23983.exe
2436	Unicorn-18027.exe
2436	Unicorn-18027.exe
548	Unicorn-22098.exe
548	Unicorn-22098.exe
1496	Unicorn-51509.exe
1496	Unicorn-51509.exe
2164	Unicorn-44912.exe
2164	Unicorn-44912.exe
2472	Unicorn-59561.exe
2472	Unicorn-59561.exe
2848	Unicorn-12634.exe
2652	Unicorn-42275.exe
2652	Unicorn-42275.exe
2848	Unicorn-12634.exe
2952	Unicorn-58777.exe
2952	Unicorn-58777.exe
2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
2176	Unicorn-55581.exe
2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
2176	Unicorn-55581.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
768	348	WerFault.exe	54
2112	2364	WerFault.exe	109

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35898.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
1496	Unicorn-51509.exe
2176	Unicorn-55581.exe
2164	Unicorn-44912.exe
1704	Unicorn-59962.exe
2768	Unicorn-25409.exe
2436	Unicorn-18027.exe
2848	Unicorn-12634.exe
3020	Unicorn-61621.exe
2692	Unicorn-15601.exe
2952	Unicorn-58777.exe
2652	Unicorn-42275.exe
2472	Unicorn-59561.exe
2216	Unicorn-23983.exe
296	Unicorn-25968.exe
548	Unicorn-22098.exe
1844	Unicorn-34422.exe
1336	Unicorn-22937.exe
1248	Unicorn-62320.exe
2780	Unicorn-35786.exe
2996	Unicorn-8236.exe
1712	Unicorn-23949.exe
2020	Unicorn-26218.exe
348	Unicorn-28766.exe
1864	Unicorn-22635.exe
1232	Unicorn-48200.exe
840	Unicorn-28501.exe
1944	Unicorn-2528.exe
1852	Unicorn-34599.exe
2484	Unicorn-29864.exe
2212	Unicorn-27064.exe
2060	Unicorn-19813.exe
1664	Unicorn-13682.exe
2252	Unicorn-65484.exe
1520	Unicorn-55131.exe
1964	Unicorn-9459.exe
2172	Unicorn-13682.exe
2292	Unicorn-65484.exe
772	Unicorn-9459.exe
2412	Unicorn-19813.exe
2304	Unicorn-19813.exe
2280	Unicorn-65484.exe
2264	Unicorn-19813.exe
936	Unicorn-32837.exe
540	Unicorn-20389.exe
2720	Unicorn-28451.exe
2824	Unicorn-34582.exe
2844	Unicorn-34582.exe
2704	Unicorn-34582.exe
2712	Unicorn-16601.exe
2056	Unicorn-44675.exe
1796	Unicorn-62058.exe
2608	Unicorn-59168.exe
2860	Unicorn-4934.exe
1564	Unicorn-54675.exe
1932	Unicorn-15500.exe
1044	Unicorn-30721.exe
1588	Unicorn-22631.exe
2000	Unicorn-29241.exe
316	Unicorn-43848.exe
1288	Unicorn-23003.exe
2964	Unicorn-32903.exe
1792	Unicorn-49681.exe
2992	Unicorn-61866.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1496	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	30
PID 2320 wrote to memory of 1496	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	30
PID 2320 wrote to memory of 1496	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	30
PID 2320 wrote to memory of 1496	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	30
PID 1496 wrote to memory of 2164	1496	Unicorn-51509.exe	31
PID 1496 wrote to memory of 2164	1496	Unicorn-51509.exe	31
PID 1496 wrote to memory of 2164	1496	Unicorn-51509.exe	31
PID 1496 wrote to memory of 2164	1496	Unicorn-51509.exe	31
PID 2320 wrote to memory of 2176	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	32
PID 2320 wrote to memory of 2176	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	32
PID 2320 wrote to memory of 2176	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	32
PID 2320 wrote to memory of 2176	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	32
PID 2176 wrote to memory of 1704	2176	Unicorn-55581.exe	33
PID 2176 wrote to memory of 1704	2176	Unicorn-55581.exe	33
PID 2176 wrote to memory of 1704	2176	Unicorn-55581.exe	33
PID 2176 wrote to memory of 1704	2176	Unicorn-55581.exe	33
PID 2320 wrote to memory of 2768	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	34
PID 2320 wrote to memory of 2768	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	34
PID 2320 wrote to memory of 2768	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	34
PID 2320 wrote to memory of 2768	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	34
PID 2164 wrote to memory of 2436	2164	Unicorn-44912.exe	35
PID 2164 wrote to memory of 2436	2164	Unicorn-44912.exe	35
PID 2164 wrote to memory of 2436	2164	Unicorn-44912.exe	35
PID 2164 wrote to memory of 2436	2164	Unicorn-44912.exe	35
PID 1496 wrote to memory of 2848	1496	Unicorn-51509.exe	36
PID 1496 wrote to memory of 2848	1496	Unicorn-51509.exe	36
PID 1496 wrote to memory of 2848	1496	Unicorn-51509.exe	36
PID 1496 wrote to memory of 2848	1496	Unicorn-51509.exe	36
PID 1704 wrote to memory of 3020	1704	Unicorn-59962.exe	37
PID 1704 wrote to memory of 3020	1704	Unicorn-59962.exe	37
PID 1704 wrote to memory of 3020	1704	Unicorn-59962.exe	37
PID 1704 wrote to memory of 3020	1704	Unicorn-59962.exe	37
PID 2176 wrote to memory of 2952	2176	Unicorn-55581.exe	38
PID 2176 wrote to memory of 2952	2176	Unicorn-55581.exe	38
PID 2176 wrote to memory of 2952	2176	Unicorn-55581.exe	38
PID 2176 wrote to memory of 2952	2176	Unicorn-55581.exe	38
PID 2768 wrote to memory of 2692	2768	Unicorn-25409.exe	39
PID 2768 wrote to memory of 2692	2768	Unicorn-25409.exe	39
PID 2768 wrote to memory of 2692	2768	Unicorn-25409.exe	39
PID 2768 wrote to memory of 2692	2768	Unicorn-25409.exe	39
PID 2320 wrote to memory of 2652	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	40
PID 2320 wrote to memory of 2652	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	40
PID 2320 wrote to memory of 2652	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	40
PID 2320 wrote to memory of 2652	2320	8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe	40
PID 2436 wrote to memory of 2216	2436	Unicorn-18027.exe	41
PID 2436 wrote to memory of 2216	2436	Unicorn-18027.exe	41
PID 2436 wrote to memory of 2216	2436	Unicorn-18027.exe	41
PID 2436 wrote to memory of 2216	2436	Unicorn-18027.exe	41
PID 2164 wrote to memory of 548	2164	Unicorn-44912.exe	42
PID 2164 wrote to memory of 548	2164	Unicorn-44912.exe	42
PID 2164 wrote to memory of 548	2164	Unicorn-44912.exe	42
PID 2164 wrote to memory of 548	2164	Unicorn-44912.exe	42
PID 2848 wrote to memory of 2472	2848	Unicorn-12634.exe	43
PID 2848 wrote to memory of 2472	2848	Unicorn-12634.exe	43
PID 2848 wrote to memory of 2472	2848	Unicorn-12634.exe	43
PID 2848 wrote to memory of 2472	2848	Unicorn-12634.exe	43
PID 1496 wrote to memory of 296	1496	Unicorn-51509.exe	44
PID 1496 wrote to memory of 296	1496	Unicorn-51509.exe	44
PID 1496 wrote to memory of 296	1496	Unicorn-51509.exe	44
PID 1496 wrote to memory of 296	1496	Unicorn-51509.exe	44
PID 3020 wrote to memory of 1844	3020	Unicorn-61621.exe	45
PID 3020 wrote to memory of 1844	3020	Unicorn-61621.exe	45
PID 3020 wrote to memory of 1844	3020	Unicorn-61621.exe	45
PID 3020 wrote to memory of 1844	3020	Unicorn-61621.exe	45

C:\Users\Admin\AppData\Local\Temp\8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe
"C:\Users\Admin\AppData\Local\Temp\8cffa1d8f54c6f678eaea7ab6cbd594a526a4007299ee263e1b97f649ba83f1c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44912.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18027.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        8⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        9⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5517.exe
        9⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        9⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
        9⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        9⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
        8⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        8⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        8⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        8⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        8⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7061.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53819.exe
        7⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        7⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64023.exe
        7⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        8⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        8⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
        8⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15249.exe
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40074.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36893.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11763.exe
        7⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        7⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12644.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9350.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31428.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23355.exe
        6⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        8⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
        8⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40818.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56537.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        6⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33734.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4439.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
        7⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        6⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36798.exe
        6⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        6⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28451.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61866.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65272.exe
        7⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5517.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1909.exe
        7⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
        6⤵
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55864.exe
        6⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
        6⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
        5⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40083.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
        6⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7942.exe
        6⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
        6⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        6⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
        5⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7126.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
        5⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        5⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51564.exe
        5⤵
        
        PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        7⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
        8⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
        8⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        8⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51239.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        7⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12295.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        7⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        6⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57395.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30118.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        6⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29870.exe
        6⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        6⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        7⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13206.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19316.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        7⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59520.exe
        6⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe
        6⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        5⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        6⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12851.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        6⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe
        5⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        5⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
        5⤵
        
        PID:7872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39297.exe
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58058.exe
        6⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59142.exe
        5⤵
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23431.exe
        5⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
        5⤵
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        5⤵
        
        PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        5⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
      4⤵
      PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41627.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10654.exe
      4⤵
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
      4⤵
      PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
      4⤵
      PID:7296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28766.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:348
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 200
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43848.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        6⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        6⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        5⤵
        
        PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53932.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
        5⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        5⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        5⤵
        
        PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48200.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
        7⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        7⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28984.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54479.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14851.exe
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        6⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        5⤵
        
        PID:2364
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 240
        6⤵
        Program crash
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
        5⤵
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        5⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        5⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        5⤵
        
        PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64355.exe
        5⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        6⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        5⤵
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        5⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        5⤵
        
        PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
      4⤵
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10961.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59337.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
        5⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        5⤵
        
        PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43391.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30129.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56831.exe
      4⤵
      PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
      4⤵
      PID:7748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1342.exe
        5⤵
        
        PID:1320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39030.exe
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        5⤵
        
        PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1909.exe
        5⤵
        
        PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
      4⤵
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        5⤵
        
        PID:324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58685.exe
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        5⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62462.exe
      4⤵
      PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
      4⤵
      PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52384.exe
      4⤵
      PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
      4⤵
      PID:8172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        5⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13206.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12290.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7880.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33734.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39966.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        5⤵
        
        PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
      4⤵
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19999.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21858.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41263.exe
        5⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        5⤵
        
        PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47542.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54479.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7701.exe
      4⤵
      PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
      4⤵
      PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37487.exe
      4⤵
      PID:7824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53135.exe
      4⤵
      PID:300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42410.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46672.exe
        5⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
        5⤵
        
        PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38784.exe
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
      4⤵
      PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
      4⤵
      PID:7592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20565.exe
    3⤵
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe
      4⤵
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
      4⤵
      PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
    3⤵
    PID:3372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
    3⤵
    PID:4888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
    3⤵
    PID:6076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
    3⤵
    PID:6448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51564.exe
    3⤵
    PID:7008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59962.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
        7⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        8⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        8⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18662.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe
        7⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29602.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37487.exe
        7⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5446.exe
        7⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        7⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18833.exe
        6⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        6⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        6⤵
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
        6⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        7⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51929.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        6⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        6⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20615.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        6⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53407.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37273.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52384.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22937.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        7⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        7⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
        6⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30118.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        6⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        6⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44611.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4439.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        6⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        5⤵
        
        PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32908.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        5⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        5⤵
        
        PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        5⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8481.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29729.exe
        6⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        6⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46417.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        5⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        5⤵
        
        PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30827.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45602.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        5⤵
        
        PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14182.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32185.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
      4⤵
      PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
      4⤵
      PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61866.exe
        6⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45661.exe
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        7⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        6⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        6⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64471.exe
        5⤵
        
        PID:976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36637.exe
        6⤵
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
        6⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
        6⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        5⤵
        
        PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36798.exe
        5⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        5⤵
        
        PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
        5⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50995.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        6⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11858.exe
        6⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        5⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exe
        5⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        5⤵
        
        PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
      4⤵
      PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        5⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        5⤵
        
        PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19130.exe
      4⤵
      PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
      4⤵
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exe
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27224.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
      4⤵
      PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
      4⤵
      PID:7432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe
        5⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30227.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48631.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        6⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        6⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30689.exe
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        5⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        5⤵
        
        PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60195.exe
      4⤵
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
        5⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        5⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
        5⤵
        
        PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37377.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60057.exe
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4934.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39376.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-927.exe
        5⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
      4⤵
      PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
      4⤵
      PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
      4⤵
      PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
    3⤵
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
      4⤵
      PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
      4⤵
      PID:7340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56622.exe
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
    3⤵
    PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20240.exe
    3⤵
    PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
    3⤵
    PID:6392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
    3⤵
    PID:8164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15601.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62320.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31810.exe
        6⤵
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44984.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32185.exe
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        6⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40167.exe
        5⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-656.exe
        6⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        5⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        5⤵
        
        PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56961.exe
        5⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26249.exe
        6⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        7⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43963.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        5⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        5⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        5⤵
        
        PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
      4⤵
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44041.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39030.exe
        5⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        5⤵
        
        PID:7368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16285.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
      4⤵
      PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
      4⤵
      PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
      4⤵
      PID:7256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
        5⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15966.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        6⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        5⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        5⤵
        
        PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
      4⤵
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        5⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        5⤵
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
      4⤵
      PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
      4⤵
      PID:7416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exe
      4⤵
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64476.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        5⤵
        
        PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32455.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40573.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
      4⤵
      PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12295.exe
      4⤵
      PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
      4⤵
      PID:7736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60899.exe
    3⤵
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54474.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59927.exe
      4⤵
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
      4⤵
      PID:7812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
    3⤵
    PID:5652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-765.exe
    3⤵
    PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
    3⤵
    PID:6284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42275.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62487.exe
        5⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20098.exe
        6⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        5⤵
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        5⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        5⤵
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32777.exe
      4⤵
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12150.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45658.exe
        5⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        5⤵
        
        PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45357.exe
      4⤵
      PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5033.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54479.exe
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
      4⤵
      PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
      4⤵
      PID:7476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29241.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14523.exe
      4⤵
      PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
        5⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        5⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        5⤵
        
        PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exe
      4⤵
      PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
      4⤵
      PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
      4⤵
      PID:7464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30982.exe
    3⤵
    PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62106.exe
      4⤵
      PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31708.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
      4⤵
      PID:7800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
    3⤵
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
    3⤵
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27224.exe
    3⤵
    PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56831.exe
    3⤵
    PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32152.exe
    3⤵
    PID:7976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61866.exe
      4⤵
      Executes dropped EXE
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exe
        5⤵
        
        PID:584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26941.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56850.exe
        5⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        5⤵
        
        PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
      4⤵
      PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
      4⤵
      PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
      4⤵
      PID:7408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
    3⤵
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29076.exe
      4⤵
      PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47228.exe
      4⤵
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6474.exe
      4⤵
      PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41263.exe
      4⤵
      PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
      4⤵
      PID:7996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39723.exe
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
    3⤵
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
    3⤵
    PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
    3⤵
    PID:5588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
    3⤵
    PID:7092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37487.exe
    3⤵
    PID:7908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
      4⤵
      PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28924.exe
      4⤵
      PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
      4⤵
      PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
      4⤵
      PID:7728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41252.exe
    3⤵
    PID:340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
    3⤵
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
    3⤵
    PID:5356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
    3⤵
    PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7061.exe
    3⤵
    PID:3028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe
  2⤵
  PID:3012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
    3⤵
    PID:3264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
    3⤵
    PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35359.exe
    3⤵
    PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
    3⤵
    PID:6500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
    3⤵
    PID:7448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22568.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22568.exe
  2⤵
  PID:920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
  2⤵
  PID:3216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32343.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32343.exe
  2⤵
  PID:4800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
  2⤵
  PID:5996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
  2⤵
  PID:6060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
  2⤵
  PID:7316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-18027.exe

Filesize
468KB

MD5
dde41563258a8774bc0daee7e5453d60

SHA1
486b45076f7769a074e7f96aaa2d891d4fe8ddf1

SHA256
4390057b940615da50af374756103a9b0b1de5c2af0f75e2955c1fda595ab389

SHA512
84b94a6eb042afa925bcb7a73599a869ec3b24cb9e886254abbc7ba1380db50f77658930d286e2f0f693797922b199cb50e159143d0aefb8d64bca536bcc005c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe

Filesize
468KB

MD5
df256367c4932f7200195e3bfe1bdd1d

SHA1
5c408b136d601052e9aadd7bfcb3d7b669a5c04d

SHA256
820ccde5d545cd2f0101aef4345b4c69dce6bf5557c17786613841bd999e9a98

SHA512
a60b4f758593aba2a3ae6ea21192d1be3ccc685460e6b92658204da7bc65eb4737956730ebce7872a3a56cb089c8862a5c6d0b3ee2db74691506501f795ff389

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe

Filesize
468KB

MD5
bb6e1d8331fb56785f944e65bb58b682

SHA1
639c1ae4c438db5486ce0bdea309b952b054a03c

SHA256
e95944e4aecb776ddc548640aae6a1d9d0ec262727e39565f43e41884aeb1bcb

SHA512
c598053c8815015ea210a52060742ca9284b885109c4fb875924039a9cf06ea99dbcde7ff74aea1eb35b41d64683a69b3d8a544334d829f33cb0ae30cea5b799

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe

Filesize
468KB

MD5
9622e26e98f2a0938bbb22b09755b28f

SHA1
0703b147f59f159fb64bc92d5144eac8850d443e

SHA256
6cca13ee8765109313cd49fdb4b7bfe85f2b40bb6361cea3ab4b12c1b9e779f0

SHA512
e5923e1c3307ccdce2e68c1fd81478b1b423a56b895705df049b94858c886e4773d0f3b9d6bc8896ec0b88e12919c5261c9e1c3ce2eceff9baa18882acea13f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exe

Filesize
468KB

MD5
1d0991844b5c17d5e9767c25a9d8c0b7

SHA1
d348c662a99764848808d8d851145884233cdd22

SHA256
1de89fe03783bb0900bb322472608505154e2d38eb9c1291e81817306a5bdd1a

SHA512
09f89259a84d03079d8ec9839897ee011e00c68190341fb4793dfdcb44db60acee6248729b5c482e596d92e5f5cd727e48560bc1fe156f968b8d798e1c75f9e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40083.exe

Filesize
468KB

MD5
0ab04eb46fd7b0191fad51c8980b0b13

SHA1
2e8ba639aaa823f5fe58321259aee239a1906f1e

SHA256
b5aa920cf3053d59f5107a679f8c538775a96cdea14844975258a2d2cdcbe0fe

SHA512
f0aeac3e73afdc8c56bc9c07d65e16b2ddea2d6078553be6ba347d814a26d1aac7901254df7d15aa77226724f2e9e0dcf3165984224eb9a99f51059fc5f26ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42275.exe

Filesize
468KB

MD5
cba68cd1239195c91674c5036e6430ed

SHA1
3a98cf0e7261ef1bb338432ea590ce5565b144f6

SHA256
e9f94f3693e6294e08c5cd00dfc29fd26760ff3f4b3b24a4fbd75599d8ee7f71

SHA512
c4142fab0d714ca1a8d954b29d4f2d6d16f0e0845a6daa2df76491e885a4b5dc87ac302b480ccf5bf22422dc2d8db567d4c731f30c7c1afe60457eb6e9e44146

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44912.exe

Filesize
468KB

MD5
cc9ff066cff9262958c71592b91e336b

SHA1
1d786cf1fcba376ca29a31950525d0adff914407

SHA256
97eb676f561c6f85fd1d8911800f32a63dab4322482e8f5d54bb91a668110b82

SHA512
a4845485cfc0777d019a6c0e57158dec923494a1166b32a145c4f51d76a3c0ffd1be3776bdf75ad4bdeae7482cc729abc9b1be5c2ae2c9df04289b0441e0c99f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5446.exe

Filesize
468KB

MD5
1ae7530fba86c52b37fad10b382acab3

SHA1
b8dcb65445d5b82793829fe39f1b0690ff5721c1

SHA256
ff4a9fb187f854b888c495d4cf8ed01f1a5a162d6920c57bcdfc9b71c46a7622

SHA512
7fa2003bc96b698c7afda146cfc2e8d4770c9c363ec121f20cfc7330eb12d45df911527a5a78394c3300d3030cf4d0ddb63d83cc994445c4da9bb97a3bf89663

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe

Filesize
468KB

MD5
17accc4454202b120e23059cc6a9f5b4

SHA1
b70adb41cc06cc034fa6e1ff4102469a2bc4e929

SHA256
a0df849ea4293e94aaf0817e63620cab9b3333d22977954fcf6efbe6dc645601

SHA512
016d7a2159d4cc4e16c84d0f23b8c3c1e45c5db0153b6b4fee83f421b72c73c0bfab4e08faa98436ff57eadb218abdf79782e65889239173bcb1ec27e707e580

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe

Filesize
468KB

MD5
92607d26bb69f3c48c4f380406fcb212

SHA1
79bc28d0f4712a89118f6eee19183ed55e02c1db

SHA256
e4cd71a33bc7b253fda4bed9b7ab616cf7a31353ef6097ae1c93cccea25f669c

SHA512
44e4e6a917cb539de533b8df089b2e2524909875b3eceb50163d68ddf1561bedcf17c015d47084342e14f9cc24f89a33dd1e7e9617862761109685fb35a04eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe

Filesize
468KB

MD5
6d9032214a7e83df32b95be8b39451f3

SHA1
3720e52f342381d1a799e3af93581ba285f2b4fd

SHA256
ea464498e766f3f807ca0b27de806038158e8c3a52e2500655e674e7f447cc9d

SHA512
4675d1390a3cf96f16006b161c03f1d349e0be3160701d991b01afcda9685b898ef9a0134d8943a877e0c0ac0da62d67a2bb2a83c96585419732e5498f3d8d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe

Filesize
468KB

MD5
855316596c7c5c151a38eb0d54c0193b

SHA1
754eba34824188e64df95fec8ea9645b28d82166

SHA256
7d3ae74dc4a46ce87e67200d4bf1f6d84b88081426a60684de24d35e32bcd237

SHA512
aad2488c38bdd798e3f4c65dffab35cb5e66aaf30e6af377569fe2064e7ab77fc86bd479852f6f7a0b1784cb04027f7e311946126b93335ce3c3f60725dfe6ef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe

Filesize
468KB

MD5
1d99f45019239e62ff0de722cb527707

SHA1
0c7243779ea8441d8442f5c22b8ccc4f17886a7f

SHA256
5bc6dea67f337905bd6626addc7b33341660714997c1c0d697d9290894db0102

SHA512
14a003ebec1b0bd57b9214ee35a6cf90f1626e383e34f69f0028b2337c8902a3cebd9996e866bb8fabbbff7ccc4252a07ee120ef1c3bfd60944622baa64d5f86

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15601.exe

Filesize
468KB

MD5
7922fad2bb36a2f650d2d83102c1f6d3

SHA1
0697319cb383870ad05b8c575d987af5af818331

SHA256
2bc290d5962a69d83d9e37958d1aeea06a54fff1639261c8f649ada897c27113

SHA512
ac8223b599748cceed52cf0cbf7017ee22271775c47738fcbf8ca04e13de7b374691b6fe6e7430f9a0681ee172680ec13d86a7c254f0670f54c03542d79a5ac0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe

Filesize
468KB

MD5
f5a0189bbd16e68638bb5dd57c6e7440

SHA1
d42cf664e72c45d0046cbd241cb173dbe7e98692

SHA256
f7f065948274ca8970b78a16081bd6b4560ecfe74a20b7ba426fde394a510652

SHA512
362a53657b8bf706bc68a068a2993ae4b1e2e53c4aa037bc3b39f843cc852a02fa6ca68960b86ffe4b249bfd345f92dc869aee007bb1450fb63956c363563bd7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22937.exe

Filesize
468KB

MD5
521057381795845f5196ff5b2e4cc812

SHA1
eb9057e2bce6151714985806c29861263295d691

SHA256
9263c042798c4fc9490af74e9f3f6a3cf187c2ee7fb35a577d9b3d698c472730

SHA512
2950e6bcefc4f0f894c9cbdfcf3d903e3497acea5b56ca50c72ed660b4021d8e1bfda0d04e8a19d0ff8da22d9cf92dce8bbb50a69df1b028fa2e0818107571a3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe

Filesize
468KB

MD5
5b53134207649abc6299822f2d484ce1

SHA1
ec38a2c8be11d4d10411655ce1b616765f351b99

SHA256
d7d3ea61bc1320b5b5afbdc7b2fdd43986633f104368238f282d15335b76e227

SHA512
fe2e3d6d5a461ebc135cffa220f2f963d1f91ea75891850855af362370df5a9feb5fdcdb799a99213d4b14d949585bba37cd8d08aee51722a720b504e8f5034d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe

Filesize
468KB

MD5
a14a4799751d9cc48ab4f43d27c77562

SHA1
f12c01e92174021c33ec46ea5b9159c6d611946d

SHA256
d5a62340a8cd08d5c7d2b220d66b8fb17c07978ca8915a231b2a3df0a7fab862

SHA512
db06f56161f0c73239b5ec51bff54c55016840b92c685da3f00e3327db6b2bbe872f00238124ea491cc043fd74ec58a37062614cff314d73741eddb023ffbb4b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe

Filesize
468KB

MD5
c9ec11e32787646501bb4ac8819a501e

SHA1
9cd3647410220c13ff439d504a76ba21f3efa3e4

SHA256
7f2cf01f6acaaa12704fa1a54e75993fc204766aa9fa10525ebd50ba98167568

SHA512
2c3189ceb5a370b50d0190f937c027ca114379671daec5f810c6eedc31bb938cee0370f4d3391f5fe7eefc9f3c748dd2ace93267cd656f6bb11dfeac464d1be5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe

Filesize
468KB

MD5
4d4da6c9f996dbafbab958794598ccd0

SHA1
ab681a36890224b871cb19ba7fd6cbfc9b3baa2b

SHA256
9735462b2ce62327602814d8bb651426b2aa93e6a510848f4ed8a6761b898f00

SHA512
fd4af14d50b24a7cb65affcae1491475b0dad1f8ec15e8e5ebf18f94755f1c351bb6ceb9900b692d4b2a9f6ffdbfbda597c0d57050b2b1d4c6738235ff79799a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe

Filesize
468KB

MD5
a165e2f023c05221db105d1dc193c4ae

SHA1
6003edbb182f77c9e73d0ed75df61a1723900aba

SHA256
61a37b70c61d6c0f2e2ff33478e783c2b05d4bf504d733976aeafc224bbd15f2

SHA512
22674d4bd9e8e408cb2d6d9351b376c20a38c4ab1618f5840565d8308e15355d13c5ca8ac1758d07c28522b03c561dc82b2df26827fd83d29b43392e700a19bb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe

Filesize
468KB

MD5
4b199a69e2ca414162d6117a703b2bcd

SHA1
d1c128a668672c6287fecca3c743273a9bf48a28

SHA256
e34a1985f34833a9969ee634e0b037c44c38cf5f5216073d4955806e0d2829c3

SHA512
3d5819cebdc6766dd46f96752bb3be327ec6a1d5a0d1598c5d8c9b5bf9366846a7ce3dca4315abbfedafa992eee3c7559b4bb1f43937a396f445dca49292e98a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe

Filesize
468KB

MD5
5ed5602a9d85673bdf81e53a55571274

SHA1
c144e23dfc93ced916074a08d7d3d92cdcc48296

SHA256
4cba4e040aebcefa44a68346b49f024b7587c8599038ec433ecb9d26329c4f02

SHA512
d7488317b865355d2a16303ee453571954cc8f558b5d3d2dc7a922c7d1991b81de14650e2afdc5b3ae9cc7bcdc215b1a1bd018eebdefef4a76b19dd20b1ed4c1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59962.exe

Filesize
468KB

MD5
e1a66c33178c4a5a8d1c6bb1592a75be

SHA1
54d691e08c184b009c8ed33274fbfeb6072c1098

SHA256
6ef432dc30cde782c39d7da93ec48297a239dd15a652ed1c51608058bbab9f7d

SHA512
010f901c32978eb409e8b5d71febbe4984f311645a5a78c508ff3c83ae031648edca8b671476093eb6a6bd438e6e6a4db59673086fada3a76546556f29653b28

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62320.exe

Filesize
468KB

MD5
8e0dad31f9afe13a6add4e470d70bd46

SHA1
4f80ad75a43d90af2025dd180a34fe14e90576ed

SHA256
6f54446f8a5ca26a3776d52aa8c6324fc973a1fcbff04d5d6eabf4600fbf79fb

SHA512
3019f033fe55fba91b64460960804e051bf6d8f018b85dcfadef36cd8de972fda3383111dc01761f1dba1654850480f09bfcb8c88bedc62b97368c45a3273b1b

Download Submit