49f2b27df834178cd9ba2d01413a82e2e1b8142bfd278bfa07bb0a74e1479520

Analysis

max time kernel
116s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8449b64f13d5a8ce1f7f675f16987e90N.exe
Size

468KB
MD5

8449b64f13d5a8ce1f7f675f16987e90
SHA1

7491992f5a159f828d6fcf2c97075f41d7fb481a
SHA256

49f2b27df834178cd9ba2d01413a82e2e1b8142bfd278bfa07bb0a74e1479520
SHA512

6ce5e4981e1b8d40dce718eb534fd139dd0f3de35745812640ba6de08d5ed9d88421b630651cfcaa98edf6c322cc3058652eeae871be96d6ffee47972cd6d375
SSDEEP

3072:gnvpovBsU35/tbYAPgc5Of8/E5RJN2XPtmHoxSWOYp+wGf9/4QlT:gnholJ/tLPV5OfbUpOYpDM9/4

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2344	Unicorn-60663.exe
2252	Unicorn-20460.exe
2460	Unicorn-5515.exe
2656	Unicorn-8577.exe
2684	Unicorn-25005.exe
3020	Unicorn-31136.exe
2944	Unicorn-11270.exe
2336	Unicorn-25743.exe
844	Unicorn-43471.exe
2432	Unicorn-22235.exe
2744	Unicorn-42101.exe
2900	Unicorn-38017.exe
2144	Unicorn-60310.exe
3004	Unicorn-27802.exe
1484	Unicorn-23134.exe
1720	Unicorn-39562.exe
1768	Unicorn-56574.exe
2304	Unicorn-65297.exe
2260	Unicorn-62604.exe
2480	Unicorn-21572.exe
2140	Unicorn-12641.exe
2540	Unicorn-56382.exe
2524	Unicorn-28348.exe
2440	Unicorn-37643.exe
2436	Unicorn-37908.exe
2404	Unicorn-37908.exe
1496	Unicorn-58420.exe
2548	Unicorn-7736.exe
924	Unicorn-40622.exe
1668	Unicorn-41944.exe
1476	Unicorn-61810.exe
1092	Unicorn-53377.exe
1968	Unicorn-8525.exe
1752	Unicorn-46029.exe
1576	Unicorn-2303.exe
1712	Unicorn-16593.exe
2060	Unicorn-57534.exe
2804	Unicorn-58089.exe
2872	Unicorn-51312.exe
2800	Unicorn-10279.exe
2832	Unicorn-57434.exe
1624	Unicorn-19216.exe
2324	Unicorn-64887.exe
2712	Unicorn-12728.exe
2720	Unicorn-12993.exe
1396	Unicorn-38874.exe
2748	Unicorn-27938.exe
840	Unicorn-47804.exe
2388	Unicorn-36429.exe
3036	Unicorn-16563.exe
2416	Unicorn-36429.exe
2976	Unicorn-10963.exe
2988	Unicorn-22593.exe
2696	Unicorn-1518.exe
1412	Unicorn-16201.exe
1944	Unicorn-17523.exe
2632	Unicorn-53725.exe
1736	Unicorn-53625.exe
2556	Unicorn-59755.exe
2292	Unicorn-10554.exe
1912	Unicorn-56226.exe
1080	Unicorn-13876.exe
2108	Unicorn-22807.exe
1416	Unicorn-15193.exe

Loads dropped DLL 64 IoCs

pid	Process
1820	8449b64f13d5a8ce1f7f675f16987e90N.exe
1820	8449b64f13d5a8ce1f7f675f16987e90N.exe
1820	8449b64f13d5a8ce1f7f675f16987e90N.exe
2344	Unicorn-60663.exe
1820	8449b64f13d5a8ce1f7f675f16987e90N.exe
2344	Unicorn-60663.exe
2252	Unicorn-20460.exe
2252	Unicorn-20460.exe
1820	8449b64f13d5a8ce1f7f675f16987e90N.exe
1820	8449b64f13d5a8ce1f7f675f16987e90N.exe
2460	Unicorn-5515.exe
2460	Unicorn-5515.exe
2344	Unicorn-60663.exe
2344	Unicorn-60663.exe
2252	Unicorn-20460.exe
2252	Unicorn-20460.exe
3020	Unicorn-31136.exe
3020	Unicorn-31136.exe
2460	Unicorn-5515.exe
2944	Unicorn-11270.exe
2460	Unicorn-5515.exe
2944	Unicorn-11270.exe
2684	Unicorn-25005.exe
2684	Unicorn-25005.exe
2344	Unicorn-60663.exe
1820	8449b64f13d5a8ce1f7f675f16987e90N.exe
1820	8449b64f13d5a8ce1f7f675f16987e90N.exe
2344	Unicorn-60663.exe
2336	Unicorn-25743.exe
2336	Unicorn-25743.exe
2252	Unicorn-20460.exe
2252	Unicorn-20460.exe
844	Unicorn-43471.exe
844	Unicorn-43471.exe
3020	Unicorn-31136.exe
3020	Unicorn-31136.exe
2144	Unicorn-60310.exe
2144	Unicorn-60310.exe
2744	Unicorn-42101.exe
2744	Unicorn-42101.exe
1820	8449b64f13d5a8ce1f7f675f16987e90N.exe
1820	8449b64f13d5a8ce1f7f675f16987e90N.exe
3004	Unicorn-27802.exe
3004	Unicorn-27802.exe
2944	Unicorn-11270.exe
2944	Unicorn-11270.exe
2344	Unicorn-60663.exe
2344	Unicorn-60663.exe
2432	Unicorn-22235.exe
2900	Unicorn-38017.exe
2432	Unicorn-22235.exe
2900	Unicorn-38017.exe
2460	Unicorn-5515.exe
2460	Unicorn-5515.exe
2684	Unicorn-25005.exe
2684	Unicorn-25005.exe
1484	Unicorn-23134.exe
1484	Unicorn-23134.exe
2336	Unicorn-25743.exe
1720	Unicorn-39562.exe
2336	Unicorn-25743.exe
1720	Unicorn-39562.exe
2252	Unicorn-20460.exe
2252	Unicorn-20460.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	2556	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-72.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57720.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1820	8449b64f13d5a8ce1f7f675f16987e90N.exe
2344	Unicorn-60663.exe
2252	Unicorn-20460.exe
2460	Unicorn-5515.exe
2656	Unicorn-8577.exe
3020	Unicorn-31136.exe
2684	Unicorn-25005.exe
2944	Unicorn-11270.exe
2336	Unicorn-25743.exe
844	Unicorn-43471.exe
2432	Unicorn-22235.exe
2144	Unicorn-60310.exe
2744	Unicorn-42101.exe
3004	Unicorn-27802.exe
2900	Unicorn-38017.exe
1484	Unicorn-23134.exe
1720	Unicorn-39562.exe
1768	Unicorn-56574.exe
2304	Unicorn-65297.exe
2260	Unicorn-62604.exe
2480	Unicorn-21572.exe
2140	Unicorn-12641.exe
2540	Unicorn-56382.exe
2524	Unicorn-28348.exe
2440	Unicorn-37643.exe
2436	Unicorn-37908.exe
2404	Unicorn-37908.exe
1496	Unicorn-58420.exe
2548	Unicorn-7736.exe
924	Unicorn-40622.exe
1668	Unicorn-41944.exe
1476	Unicorn-61810.exe
1092	Unicorn-53377.exe
1968	Unicorn-8525.exe
1752	Unicorn-46029.exe
1576	Unicorn-2303.exe
2060	Unicorn-57534.exe
1712	Unicorn-16593.exe
2804	Unicorn-58089.exe
2872	Unicorn-51312.exe
2800	Unicorn-10279.exe
2832	Unicorn-57434.exe
1624	Unicorn-19216.exe
2324	Unicorn-64887.exe
2712	Unicorn-12728.exe
2720	Unicorn-12993.exe
840	Unicorn-47804.exe
1396	Unicorn-38874.exe
2748	Unicorn-27938.exe
2388	Unicorn-36429.exe
2416	Unicorn-36429.exe
3036	Unicorn-16563.exe
2976	Unicorn-10963.exe
2988	Unicorn-22593.exe
2696	Unicorn-1518.exe
1412	Unicorn-16201.exe
1944	Unicorn-17523.exe
2632	Unicorn-53725.exe
1736	Unicorn-53625.exe
2556	Unicorn-59755.exe
1912	Unicorn-56226.exe
2292	Unicorn-10554.exe
1080	Unicorn-13876.exe
2108	Unicorn-22807.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2344	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	29
PID 1820 wrote to memory of 2344	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	29
PID 1820 wrote to memory of 2344	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	29
PID 1820 wrote to memory of 2344	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	29
PID 1820 wrote to memory of 2252	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	30
PID 1820 wrote to memory of 2252	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	30
PID 1820 wrote to memory of 2252	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	30
PID 1820 wrote to memory of 2252	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	30
PID 2344 wrote to memory of 2460	2344	Unicorn-60663.exe	31
PID 2344 wrote to memory of 2460	2344	Unicorn-60663.exe	31
PID 2344 wrote to memory of 2460	2344	Unicorn-60663.exe	31
PID 2344 wrote to memory of 2460	2344	Unicorn-60663.exe	31
PID 2252 wrote to memory of 2656	2252	Unicorn-20460.exe	32
PID 2252 wrote to memory of 2656	2252	Unicorn-20460.exe	32
PID 2252 wrote to memory of 2656	2252	Unicorn-20460.exe	32
PID 2252 wrote to memory of 2656	2252	Unicorn-20460.exe	32
PID 1820 wrote to memory of 2684	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	33
PID 1820 wrote to memory of 2684	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	33
PID 1820 wrote to memory of 2684	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	33
PID 1820 wrote to memory of 2684	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	33
PID 2460 wrote to memory of 3020	2460	Unicorn-5515.exe	34
PID 2460 wrote to memory of 3020	2460	Unicorn-5515.exe	34
PID 2460 wrote to memory of 3020	2460	Unicorn-5515.exe	34
PID 2460 wrote to memory of 3020	2460	Unicorn-5515.exe	34
PID 2344 wrote to memory of 2944	2344	Unicorn-60663.exe	35
PID 2344 wrote to memory of 2944	2344	Unicorn-60663.exe	35
PID 2344 wrote to memory of 2944	2344	Unicorn-60663.exe	35
PID 2344 wrote to memory of 2944	2344	Unicorn-60663.exe	35
PID 2252 wrote to memory of 2336	2252	Unicorn-20460.exe	36
PID 2252 wrote to memory of 2336	2252	Unicorn-20460.exe	36
PID 2252 wrote to memory of 2336	2252	Unicorn-20460.exe	36
PID 2252 wrote to memory of 2336	2252	Unicorn-20460.exe	36
PID 3020 wrote to memory of 844	3020	Unicorn-31136.exe	37
PID 3020 wrote to memory of 844	3020	Unicorn-31136.exe	37
PID 3020 wrote to memory of 844	3020	Unicorn-31136.exe	37
PID 3020 wrote to memory of 844	3020	Unicorn-31136.exe	37
PID 2460 wrote to memory of 2432	2460	Unicorn-5515.exe	38
PID 2460 wrote to memory of 2432	2460	Unicorn-5515.exe	38
PID 2460 wrote to memory of 2432	2460	Unicorn-5515.exe	38
PID 2460 wrote to memory of 2432	2460	Unicorn-5515.exe	38
PID 2944 wrote to memory of 2744	2944	Unicorn-11270.exe	39
PID 2944 wrote to memory of 2744	2944	Unicorn-11270.exe	39
PID 2944 wrote to memory of 2744	2944	Unicorn-11270.exe	39
PID 2944 wrote to memory of 2744	2944	Unicorn-11270.exe	39
PID 2684 wrote to memory of 2900	2684	Unicorn-25005.exe	40
PID 2684 wrote to memory of 2900	2684	Unicorn-25005.exe	40
PID 2684 wrote to memory of 2900	2684	Unicorn-25005.exe	40
PID 2684 wrote to memory of 2900	2684	Unicorn-25005.exe	40
PID 1820 wrote to memory of 2144	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	42
PID 1820 wrote to memory of 2144	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	42
PID 1820 wrote to memory of 2144	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	42
PID 1820 wrote to memory of 2144	1820	8449b64f13d5a8ce1f7f675f16987e90N.exe	42
PID 2344 wrote to memory of 3004	2344	Unicorn-60663.exe	41
PID 2344 wrote to memory of 3004	2344	Unicorn-60663.exe	41
PID 2344 wrote to memory of 3004	2344	Unicorn-60663.exe	41
PID 2344 wrote to memory of 3004	2344	Unicorn-60663.exe	41
PID 2336 wrote to memory of 1484	2336	Unicorn-25743.exe	43
PID 2336 wrote to memory of 1484	2336	Unicorn-25743.exe	43
PID 2336 wrote to memory of 1484	2336	Unicorn-25743.exe	43
PID 2336 wrote to memory of 1484	2336	Unicorn-25743.exe	43
PID 2252 wrote to memory of 1720	2252	Unicorn-20460.exe	44
PID 2252 wrote to memory of 1720	2252	Unicorn-20460.exe	44
PID 2252 wrote to memory of 1720	2252	Unicorn-20460.exe	44
PID 2252 wrote to memory of 1720	2252	Unicorn-20460.exe	44

C:\Users\Admin\AppData\Local\Temp\8449b64f13d5a8ce1f7f675f16987e90N.exe
"C:\Users\Admin\AppData\Local\Temp\8449b64f13d5a8ce1f7f675f16987e90N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5515.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43471.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56574.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22807.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        9⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        9⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        9⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        9⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exe
        8⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        8⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe
        7⤵
        Executes dropped EXE
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        8⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
        9⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
        9⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21238.exe
        8⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17.exe
        8⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        8⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3485.exe
        7⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19365.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13649.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        7⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe
        7⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        9⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        8⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        8⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64825.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38566.exe
        7⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29439.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7294.exe
        6⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49202.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32665.exe
        7⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe
        6⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54920.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65297.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
        7⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        8⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17726.exe
        8⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        8⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        8⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16148.exe
        7⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53450.exe
        6⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49875.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
        7⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29883.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14900.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16593.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33689.exe
        6⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33793.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-814.exe
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        7⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50684.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        5⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        6⤵
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        6⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1619.exe
        5⤵
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9342.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22235.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56294.exe
        7⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
        8⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5617.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
        7⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3372.exe
        6⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        6⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22593.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
        6⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26718.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10137.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21238.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        6⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
        5⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exe
        5⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58420.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        6⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9174.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        7⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23267.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28177.exe
        5⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29883.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        5⤵
        
        PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        5⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8377.exe
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
      4⤵
      PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18968.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
      4⤵
      PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
      4⤵
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
      4⤵
      PID:6204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42101.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21572.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
        7⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29709.exe
        8⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        9⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54019.exe
        9⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        8⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        8⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21410.exe
        7⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        7⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        7⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30315.exe
        6⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
        7⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29883.exe
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55003.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47014.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16563.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        6⤵
        
        PID:356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        5⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57081.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47934.exe
        6⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        6⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40896.exe
        5⤵
        
        PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe
        5⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
        6⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        5⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
      4⤵
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        5⤵
        
        PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
      4⤵
      PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27852.exe
      4⤵
      PID:6324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23191.exe
        6⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        6⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64825.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        5⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        6⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9174.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43122.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28360.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exe
        5⤵
        
        PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        5⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18825.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        5⤵
        
        PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
      4⤵
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4156.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7503.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
      4⤵
      PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37643.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
      4⤵
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49252.exe
        5⤵
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        5⤵
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38874.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21053.exe
      4⤵
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        5⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe
      4⤵
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64825.exe
      4⤵
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51550.exe
    3⤵
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
      4⤵
      PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
      4⤵
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
      4⤵
      PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53597.exe
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42751.exe
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exe
    3⤵
    PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36100.exe
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6208.exe
    3⤵
    PID:5244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
        7⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27595.exe
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32420.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        7⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43117.exe
        6⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17523.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        6⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        6⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe
        5⤵
        
        PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53725.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        6⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41542.exe
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
        5⤵
        
        PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28173.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22401.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
      4⤵
      PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63752.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
      4⤵
      PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61810.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59755.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 240
        6⤵
        Program crash
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        5⤵
        
        PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        5⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4419.exe
      4⤵
      PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28775.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
      4⤵
      PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
        5⤵
        
        PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21784.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        5⤵
        
        PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
      4⤵
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
      4⤵
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
      4⤵
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
      4⤵
      PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31160.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
      4⤵
      PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
    3⤵
    PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53348.exe
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
    3⤵
    PID:6152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38017.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        6⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        7⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16148.exe
        6⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16687.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        5⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20391.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        5⤵
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6709.exe
        5⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34862.exe
        6⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31160.exe
        6⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36568.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18825.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        5⤵
        
        PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
      4⤵
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52893.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13649.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
      4⤵
      PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7736.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3694.exe
        5⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
        6⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59375.exe
        5⤵
        
        PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46944.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60357.exe
      4⤵
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
      4⤵
      PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
      4⤵
      PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
      4⤵
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2184.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
    3⤵
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
      4⤵
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
    3⤵
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
      4⤵
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
      4⤵
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
    3⤵
    PID:4020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
    3⤵
    PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23652.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60310.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60310.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16585.exe
        5⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48458.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31933.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
      4⤵
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        5⤵
        
        PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21850.exe
      4⤵
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
      4⤵
      PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
      4⤵
      PID:292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        5⤵
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27104.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14538.exe
    3⤵
    PID:940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33793.exe
      4⤵
      PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
      4⤵
      PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34079.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30914.exe
        5⤵
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
      4⤵
      PID:5944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
    3⤵
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
    3⤵
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
    3⤵
    PID:5572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
    3⤵
    PID:6848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28021.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33155.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47301.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
      4⤵
      PID:6040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62364.exe
    3⤵
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44274.exe
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
    3⤵
    PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
    3⤵
    PID:6396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe
    3⤵
    PID:352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
      4⤵
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54920.exe
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
      4⤵
      PID:6800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
    3⤵
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32857.exe
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
    3⤵
    PID:3816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
    3⤵
    PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13119.exe
    3⤵
    PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64825.exe
    3⤵
    PID:5416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41781.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41781.exe
  2⤵
  PID:2484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31261.exe
    3⤵
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
    3⤵
    PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34642.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
  2⤵
  PID:3104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
  2⤵
  PID:4064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52213.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52213.exe
  2⤵
  PID:5000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
  2⤵
  PID:5424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
  2⤵
  PID:5712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-22235.exe

Filesize
468KB

MD5
6fa67e9fa997344ca507860837426fbe

SHA1
3ee29e00637281b74571648b5d2751b44e0ff725

SHA256
8b6f473fc2b1af8712cd2c0cb35ce4861a3998c51344ce6632ba42434af69e43

SHA512
096a1e15c88a6e314b5e66471dde2d0ad00ac2d10197e4e741034374a483715f1a1b1243c5e61a97960f151d6f5816c03c0e1ad34bd61fd07a865624672e66e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe

Filesize
468KB

MD5
5e16dd3286df04cbcdc7b888b6c64c64

SHA1
a97301c754e48be66e3a3543402257b3f7995118

SHA256
301f0940979cf0b8ce6754f607305fc454e867e2c8a3ea64855484b71c473374

SHA512
9031df3c37ff4873412a32d6601426526356ad742384728e845d92efb4de2695471ae8e5bad78911f02400da7580a7aea8ab9f24e8f250a4e7a926a61992457c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38017.exe

Filesize
468KB

MD5
7fa8232653404736e56eff4b4aab4799

SHA1
621e036b07b2f79be27ab7777ce2c0503a58420b

SHA256
5674823613f1923b57ce8ba9ab30c1fdc9839661b4a6e3972c2795c81df71610

SHA512
94592001ca6c04c3803d9669a408a130676143492c04d4664dad13e6d650be1784c596bfba1db3e48fb8c3830846d1bd5f3f4cbb86659288eae01e2457200ee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe

Filesize
468KB

MD5
4ff8b4b1ab0b7ecc482bc0b92d851cee

SHA1
9a5d8944623c61fb7ae5f0e82ad3ad7806c6d845

SHA256
ab9155ea8b7e4a0747ab1971db43b5cb8d081f27ed27b8d3e5534534337bb677

SHA512
12400bc47dddb9562bb78867eeb6c6f5d5ba9a04df815cd48e03f32eae7ba6fd73ed7c74d5a239fe667042d1e1e53cdedf5d1aa155ba5c78f96788a9be0cb192

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe

Filesize
468KB

MD5
321a0430260d45ba6522c617aacae760

SHA1
0a5f58318cc6128a838d8a2079b410bc7b6a4e60

SHA256
7ff0fe779f2415f4b4fe7b89b64e497e6a3d181cb3edea2d0417fe0149b571c7

SHA512
69112c20cee3484f6dcc1a95a3060889efb54e56acc45d32b5ee8f3c8fe5b098ff7bba4e219bc48cde39b794261619400affca3d32756468cba9650d2a900be0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe

Filesize
468KB

MD5
531a6aabeecd9140b8a9643a998c7abe

SHA1
a1fdbd9c05925b80383e232ba960638c9551ef81

SHA256
743edc1a646369e72fa2bf283794e9dff5eb7e184d730d38d5f963ad4a2e9ad6

SHA512
2299b3ee7be6d337b5f9f99a411ecabaf7c8e7e88957bb5d8cdf602732acc616a5084ef11e9b38e9184c9c179a479bc4e66af340231845f86b64688b30fe0e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42101.exe

Filesize
468KB

MD5
fe999fa64e4511569caefd233574ae97

SHA1
756dff75daa2f699f0e2b9886301ab43724eaf30

SHA256
5a3c22f997e5575de5634415833d480ad640b3b284b57ce8cd192786b6aa15e9

SHA512
bee8c9155e7dae299d7fa854f314953c507edc730c58d5c40dedb7af2d1637c37fc46d5193f144dc89508ea887456b701358d0fa9ffc20579c3f14cac8e6cc58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe

Filesize
468KB

MD5
cbfec1109ef8a82d7c276f09bafcee4e

SHA1
c0ac73619a6623d0f12e3abd578ca3c9f016e230

SHA256
373304494fb6f64a33f17a255ac5adf7d35b40defe297c28ce9ace1c671186bb

SHA512
4be331b74a022f9fdb7d4fadf0401f16eedf83c15af5917d15416b270e301c7a80d134a598e404151c6ea49b93dbd7365e1f0513af6f9a5354d18b4479d334a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe

Filesize
468KB

MD5
263222e0710dc8bedeace606a5c7bf1d

SHA1
49573d974f1f5fe6193501ffdc7c1c07d04e8327

SHA256
fe47721381f987e218b97b52152da97533e57bede788cc51bc9570b5c6054018

SHA512
3e46ef50a6d3d0e80ad7a7a9fa14a7495ef17b8fe0559af26e913414f665dbff072301cdc35b12119f6b1609a23eb7a6c11a60b494d13ca378e0761791540d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5515.exe

Filesize
468KB

MD5
ab6a4e5d1b2fdf883759b5be48cb8f3f

SHA1
5227df961d80eef3fbb8a5e3cf1cb663d5f421e7

SHA256
77c3ab95814c80cf61d144c93ba00a2d68acbde117831292f2e12a63262f9f3b

SHA512
d04480c365263d5c98018881cab2da5b913713b8f05c4415726cd7b5aa21c36162beb4ce5bb8c4c8262903b59c50721348c9a39720eef8eb09b7d2601be1dc6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60310.exe

Filesize
468KB

MD5
d3cc1be2d568ee410fdd79a2745aaae1

SHA1
4204151533558d5bf36f8c38bcbffd7601fd063e

SHA256
5ea87c9ab9c92bcf6d24019685b3235e67d1a8fa4a50d6936f9942ff494f3eff

SHA512
9703e85e0eaf536c7eb0f0fa710819a07434aef3728746d8725c5857b9c7a227696598803927bb8a6169cae8083aacdab6e82f6746ac4d5fdce922c281cc594d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe

Filesize
468KB

MD5
db1a2cb0d9cc2b188b310156447d8a15

SHA1
cd4571dd5cc1a82e8f0a63e49b82bee05bd4c910

SHA256
408d5aa86d66b90054fae170746f5a176aa22fb531d6b783aecb820281496404

SHA512
1b58dca8b30ed07c2468487fb7b0488efe9327a3d61336f297937817aa81775ea72a95b3de3f148909573713423e23a09c8c64fc80828dc794e0c24101fde3c8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe

Filesize
468KB

MD5
27bea0d0df0aac396cb0f1add9f062d1

SHA1
0a730d77bc60e6293559f5748c349fbd0b038e6f

SHA256
8e4ace0c4baa54a2b7b2d292ed4bfff23290a903215323b2f3d9e7d425de81a4

SHA512
53bc9b688ecc52212f1867c8ac8c13a3fc47f4326e7ddd606b49bb5a8b2e5d3b6823636d2d39d3b80edea33c470f8b5f224d9d5a379c69f1f52192fa52e077d5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe

Filesize
468KB

MD5
d03236e09689c15feace08ad65fcc5b0

SHA1
13dd63b095bf7623003b761fb1de26533e07efe2

SHA256
99931bb3b2640638f0ff0edd8d555e72b7e184ab0a7b48ec4675264fe81455b3

SHA512
f2a54a088653034043ff101ceab626d2c652ca3e6a8bd1e2db12bc448503f0729638269a1d47a4cbe5ff1276e8d888ccdc9c330ba29a7ca6942020b740127717

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe

Filesize
468KB

MD5
ddfa7081519a83866dfa8f688451aa63

SHA1
25a1cc53389d2ad04d54c66187843dbe575a2908

SHA256
58e139549fd72af5028dac8cc86eded548fb50d92ffafad83d9416deaceadefa

SHA512
531de53d5557d9648bdcabe15292821fb25f70f95e7946c0e64d1074fe1d60af7ce292024562f9faf4f5991cdd8165f399d443e2963c32fec365affa7805ce1e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe

Filesize
468KB

MD5
5f92b2f4f97b7b85c2a04dbf4f392170

SHA1
2f233256827c7f74046f43330a764924aed7b9be

SHA256
eaf06406b3017603a4ab9f5bfc5266e3963e57ff54db4072b379b57f353629d9

SHA512
6be0844a9e443e4172fb05611a2a0d22f06c4eefe8f6542f98f36d87793d1cdaa3a777bd20d2c70f0d3808f2f5d73855fceece7b1ce52b058e04791584a4cb8a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe

Filesize
468KB

MD5
0311179c158c68b6443d7029957f2e4e

SHA1
56bb6aec333eb2a75a7b692306ba51efd5feec51

SHA256
1e45f2a37b21b461ee66fc16b8a4a0403b4084e5b8a3925716612f747927b137

SHA512
92032628172d2eda65ff496dbf86495918404a1ef642f4bcf134f68c60597691b16daa4aafd15bc849978d61aa726d18faf13864e8bb4ca76f6a7ecaa96b947e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe

Filesize
468KB

MD5
d95a1699ef6671f9ec18471b3234564c

SHA1
d1d30f9b74bcb55c432e4571b35b81a84f050014

SHA256
5278a87588e721939b06b3f0b2500bcecadee499c91a12bd39a70cfd744e95c9

SHA512
c638318f4fc3e49a1c419ee83e8882ac6bb9c0402a2d3f3bc8653532458bfc724c8f37030044a72265e942776b1e22b3bb44b065eaa227a44dbe238d86606640

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43471.exe

Filesize
468KB

MD5
0ede6e6cfe75bb2a1d6795b9acbc4e9e

SHA1
4c83b733b245f0744fd36dc9ff75724b5ef80ac5

SHA256
200b3dc57ea034c231e06f49d59eb315ade4639d448478e97bbb00e938d9d556

SHA512
1663bea1ae890829fc5987e9d11150e0bc71da43c9c44b6bf1937da6298396fed1bb6298a85e1ce5d0ae439a39e9fdeb73ff4a75e0010005890f472fc0a11b41

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56574.exe

Filesize
468KB

MD5
d7672c8460eadf57bb81549fda3e21fd

SHA1
14fad5b8ea1c36c73e668b3c33c17aef5776c273

SHA256
5b2ce1f205f816f6b5c5c8e411d9403c574959921b5c7083ed098157a8179e71

SHA512
2dcce6adc92d4db98b2993e59a65d6115d1faad087bbc0d59d20e25cc0948cf46187a014cb002409cff88fb23d4c55a5985e99a03f37cc25cc0b71203403b3cb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe

Filesize
468KB

MD5
3fc53d43d2e317fee5cda47ae9aac772

SHA1
320737fd66fec121292e56294a2867ffaee325ce

SHA256
81bf52bc7eb62ff66bcd2904c7f72c3917ead0df0e8e3a30b3012c7ba0493a5a

SHA512
61e8ff78e88af63ae5834f090609b0378f56490de1d6cdb403e3e84c94be3897cddd5bfd54c20b879526dc8605df2e5fb23fe6d9ee4203a769a42a8b3074995b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe

Filesize
468KB

MD5
6bfb12c2ca622461daecad6aa04a0c6a

SHA1
f5a082e392da172ca96205f1cc99d78fa1c986ee

SHA256
6d29a9c1624fb37e6c521dfaf078bf0f66ac50a8ef8f29ce725566d8124dc3b0

SHA512
948b3c8299486e435da06665c6036dbee632c57ae80c2d73d33285a5e1e0dacc27f4177c85fbf8fba551a31ea37580672c63d88bf18287d76674adbaaf052484

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65297.exe

Filesize
468KB

MD5
4590f35846a04808f865479eb04ebf98

SHA1
1e0b6840e6b1094c023d5770751359732a7fc1ab

SHA256
7339f4f7bc459e621fb9ab23c98cd83d20b5b6d390d95fe2789335647266d8d5

SHA512
108f7278a3687d41e250f0a873025a0a1fde7db4a40943743848657d19fb5f064d42560e9a0ed0fbc281add0c2054661ccc596e8db394fd1a6185dbdfd969a71

Download Submit