24fb8cde06dc6d5de09671cd940ce603de9990e924b58660d2f285b80c14dd00

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

35dbf1cba7f399b985e24a1281b9f960N.exe
Size

468KB
MD5

35dbf1cba7f399b985e24a1281b9f960
SHA1

c78eb890cc54999ae1e2db8c80893c88deb06ece
SHA256

24fb8cde06dc6d5de09671cd940ce603de9990e924b58660d2f285b80c14dd00
SHA512

be67c930d0fcccb57b9d24182b4ab093513e73defd89146c8744dfed3857aa1cb96ab4547307604f87ffbff0d9a533080762b780a42e8c9c7cd7a0dd8715b788
SSDEEP

3072:1bBIogIdFn5UtbYbHzcjVf8/EChCy7/CbLH0xVPiNf92cxWueVe5:1baod5UtEH4jVfCjRGNfMAWue

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2172	Unicorn-26193.exe
2640	Unicorn-26043.exe
2064	Unicorn-26104.exe
2804	Unicorn-45916.exe
2824	Unicorn-29087.exe
2788	Unicorn-9221.exe
2580	Unicorn-7305.exe
2576	Unicorn-54318.exe
3008	Unicorn-51230.exe
2000	Unicorn-21463.exe
2068	Unicorn-41329.exe
2052	Unicorn-2334.exe
2364	Unicorn-8464.exe
1624	Unicorn-58661.exe
1920	Unicorn-58008.exe
1280	Unicorn-5278.exe
2908	Unicorn-8314.exe
2876	Unicorn-52646.exe
2772	Unicorn-9082.exe
1908	Unicorn-58610.exe
1916	Unicorn-33320.exe
1680	Unicorn-39512.exe
1744	Unicorn-59186.exe
1532	Unicorn-50473.exe
1360	Unicorn-50738.exe
2532	Unicorn-64505.exe
2168	Unicorn-25746.exe
2320	Unicorn-585.exe
1860	Unicorn-49869.exe
1856	Unicorn-49869.exe
3044	Unicorn-60948.exe
3064	Unicorn-59224.exe
1576	Unicorn-6828.exe
2088	Unicorn-20211.exe
2852	Unicorn-39620.exe
2916	Unicorn-18972.exe
2744	Unicorn-31970.exe
2840	Unicorn-31935.exe
2724	Unicorn-63107.exe
2692	Unicorn-17436.exe
2808	Unicorn-30412.exe
2556	Unicorn-36278.exe
3048	Unicorn-56086.exe
1888	Unicorn-30988.exe
1028	Unicorn-4316.exe
2520	Unicorn-24182.exe
1996	Unicorn-24182.exe
1336	Unicorn-2204.exe
1716	Unicorn-22070.exe
2896	Unicorn-12639.exe
2428	Unicorn-29174.exe
964	Unicorn-49527.exe
1724	Unicorn-16562.exe
2020	Unicorn-27357.exe
1880	Unicorn-47991.exe
1528	Unicorn-15703.exe
2204	Unicorn-19485.exe
712	Unicorn-61374.exe
2456	Unicorn-59278.exe
1872	Unicorn-53916.exe
1796	Unicorn-40529.exe
1572	Unicorn-19350.exe
1552	Unicorn-65287.exe
1708	Unicorn-57368.exe

Loads dropped DLL 64 IoCs

pid	Process
2492	35dbf1cba7f399b985e24a1281b9f960N.exe
2492	35dbf1cba7f399b985e24a1281b9f960N.exe
2172	Unicorn-26193.exe
2172	Unicorn-26193.exe
2492	35dbf1cba7f399b985e24a1281b9f960N.exe
2492	35dbf1cba7f399b985e24a1281b9f960N.exe
2640	Unicorn-26043.exe
2640	Unicorn-26043.exe
2064	Unicorn-26104.exe
2172	Unicorn-26193.exe
2064	Unicorn-26104.exe
2172	Unicorn-26193.exe
2492	35dbf1cba7f399b985e24a1281b9f960N.exe
2492	35dbf1cba7f399b985e24a1281b9f960N.exe
2804	Unicorn-45916.exe
2804	Unicorn-45916.exe
2640	Unicorn-26043.exe
2640	Unicorn-26043.exe
2064	Unicorn-26104.exe
2788	Unicorn-9221.exe
2064	Unicorn-26104.exe
2788	Unicorn-9221.exe
2580	Unicorn-7305.exe
2172	Unicorn-26193.exe
2580	Unicorn-7305.exe
2172	Unicorn-26193.exe
2492	35dbf1cba7f399b985e24a1281b9f960N.exe
2492	35dbf1cba7f399b985e24a1281b9f960N.exe
2576	Unicorn-54318.exe
2576	Unicorn-54318.exe
2804	Unicorn-45916.exe
2804	Unicorn-45916.exe
3008	Unicorn-51230.exe
3008	Unicorn-51230.exe
2640	Unicorn-26043.exe
2640	Unicorn-26043.exe
2000	Unicorn-21463.exe
2000	Unicorn-21463.exe
2068	Unicorn-41329.exe
2068	Unicorn-41329.exe
2064	Unicorn-26104.exe
2064	Unicorn-26104.exe
2788	Unicorn-9221.exe
2788	Unicorn-9221.exe
2052	Unicorn-2334.exe
2052	Unicorn-2334.exe
2172	Unicorn-26193.exe
2172	Unicorn-26193.exe
2364	Unicorn-8464.exe
2364	Unicorn-8464.exe
2580	Unicorn-7305.exe
2580	Unicorn-7305.exe
2492	35dbf1cba7f399b985e24a1281b9f960N.exe
2492	35dbf1cba7f399b985e24a1281b9f960N.exe
1920	Unicorn-58008.exe
1920	Unicorn-58008.exe
2908	Unicorn-8314.exe
1280	Unicorn-5278.exe
2908	Unicorn-8314.exe
1280	Unicorn-5278.exe
3008	Unicorn-51230.exe
3008	Unicorn-51230.exe
2804	Unicorn-45916.exe
2804	Unicorn-45916.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	2724	WerFault.exe	69

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57376.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2492	35dbf1cba7f399b985e24a1281b9f960N.exe
2172	Unicorn-26193.exe
2640	Unicorn-26043.exe
2064	Unicorn-26104.exe
2804	Unicorn-45916.exe
2824	Unicorn-29087.exe
2788	Unicorn-9221.exe
2580	Unicorn-7305.exe
2576	Unicorn-54318.exe
3008	Unicorn-51230.exe
2068	Unicorn-41329.exe
2000	Unicorn-21463.exe
2052	Unicorn-2334.exe
2364	Unicorn-8464.exe
1624	Unicorn-58661.exe
1920	Unicorn-58008.exe
1280	Unicorn-5278.exe
2908	Unicorn-8314.exe
2876	Unicorn-52646.exe
2772	Unicorn-9082.exe
1916	Unicorn-33320.exe
1908	Unicorn-58610.exe
1680	Unicorn-39512.exe
1744	Unicorn-59186.exe
1360	Unicorn-50738.exe
1532	Unicorn-50473.exe
2532	Unicorn-64505.exe
2168	Unicorn-25746.exe
2320	Unicorn-585.exe
1856	Unicorn-49869.exe
1860	Unicorn-49869.exe
3044	Unicorn-60948.exe
3064	Unicorn-59224.exe
1576	Unicorn-6828.exe
2088	Unicorn-20211.exe
2916	Unicorn-18972.exe
2852	Unicorn-39620.exe
2744	Unicorn-31970.exe
2840	Unicorn-31935.exe
2724	Unicorn-63107.exe
2692	Unicorn-17436.exe
2556	Unicorn-36278.exe
2808	Unicorn-30412.exe
3048	Unicorn-56086.exe
1888	Unicorn-30988.exe
1028	Unicorn-4316.exe
1996	Unicorn-24182.exe
2520	Unicorn-24182.exe
1336	Unicorn-2204.exe
1716	Unicorn-22070.exe
2896	Unicorn-12639.exe
2428	Unicorn-29174.exe
964	Unicorn-49527.exe
1724	Unicorn-16562.exe
2020	Unicorn-27357.exe
1880	Unicorn-47991.exe
1528	Unicorn-15703.exe
2204	Unicorn-19485.exe
712	Unicorn-61374.exe
2456	Unicorn-59278.exe
1872	Unicorn-53916.exe
1796	Unicorn-40529.exe
1552	Unicorn-65287.exe
1572	Unicorn-19350.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2172	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	31
PID 2492 wrote to memory of 2172	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	31
PID 2492 wrote to memory of 2172	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	31
PID 2492 wrote to memory of 2172	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	31
PID 2172 wrote to memory of 2640	2172	Unicorn-26193.exe	32
PID 2172 wrote to memory of 2640	2172	Unicorn-26193.exe	32
PID 2172 wrote to memory of 2640	2172	Unicorn-26193.exe	32
PID 2172 wrote to memory of 2640	2172	Unicorn-26193.exe	32
PID 2492 wrote to memory of 2064	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	33
PID 2492 wrote to memory of 2064	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	33
PID 2492 wrote to memory of 2064	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	33
PID 2492 wrote to memory of 2064	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	33
PID 2640 wrote to memory of 2804	2640	Unicorn-26043.exe	34
PID 2640 wrote to memory of 2804	2640	Unicorn-26043.exe	34
PID 2640 wrote to memory of 2804	2640	Unicorn-26043.exe	34
PID 2640 wrote to memory of 2804	2640	Unicorn-26043.exe	34
PID 2064 wrote to memory of 2824	2064	Unicorn-26104.exe	35
PID 2064 wrote to memory of 2824	2064	Unicorn-26104.exe	35
PID 2064 wrote to memory of 2824	2064	Unicorn-26104.exe	35
PID 2064 wrote to memory of 2824	2064	Unicorn-26104.exe	35
PID 2172 wrote to memory of 2788	2172	Unicorn-26193.exe	36
PID 2172 wrote to memory of 2788	2172	Unicorn-26193.exe	36
PID 2172 wrote to memory of 2788	2172	Unicorn-26193.exe	36
PID 2172 wrote to memory of 2788	2172	Unicorn-26193.exe	36
PID 2492 wrote to memory of 2580	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	37
PID 2492 wrote to memory of 2580	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	37
PID 2492 wrote to memory of 2580	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	37
PID 2492 wrote to memory of 2580	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	37
PID 2804 wrote to memory of 2576	2804	Unicorn-45916.exe	38
PID 2804 wrote to memory of 2576	2804	Unicorn-45916.exe	38
PID 2804 wrote to memory of 2576	2804	Unicorn-45916.exe	38
PID 2804 wrote to memory of 2576	2804	Unicorn-45916.exe	38
PID 2640 wrote to memory of 3008	2640	Unicorn-26043.exe	39
PID 2640 wrote to memory of 3008	2640	Unicorn-26043.exe	39
PID 2640 wrote to memory of 3008	2640	Unicorn-26043.exe	39
PID 2640 wrote to memory of 3008	2640	Unicorn-26043.exe	39
PID 2788 wrote to memory of 2068	2788	Unicorn-9221.exe	41
PID 2788 wrote to memory of 2068	2788	Unicorn-9221.exe	41
PID 2788 wrote to memory of 2068	2788	Unicorn-9221.exe	41
PID 2788 wrote to memory of 2068	2788	Unicorn-9221.exe	41
PID 2064 wrote to memory of 2000	2064	Unicorn-26104.exe	40
PID 2064 wrote to memory of 2000	2064	Unicorn-26104.exe	40
PID 2064 wrote to memory of 2000	2064	Unicorn-26104.exe	40
PID 2064 wrote to memory of 2000	2064	Unicorn-26104.exe	40
PID 2580 wrote to memory of 2364	2580	Unicorn-7305.exe	42
PID 2580 wrote to memory of 2364	2580	Unicorn-7305.exe	42
PID 2580 wrote to memory of 2364	2580	Unicorn-7305.exe	42
PID 2580 wrote to memory of 2364	2580	Unicorn-7305.exe	42
PID 2172 wrote to memory of 2052	2172	Unicorn-26193.exe	43
PID 2172 wrote to memory of 2052	2172	Unicorn-26193.exe	43
PID 2172 wrote to memory of 2052	2172	Unicorn-26193.exe	43
PID 2172 wrote to memory of 2052	2172	Unicorn-26193.exe	43
PID 2492 wrote to memory of 1624	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	44
PID 2492 wrote to memory of 1624	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	44
PID 2492 wrote to memory of 1624	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	44
PID 2492 wrote to memory of 1624	2492	35dbf1cba7f399b985e24a1281b9f960N.exe	44
PID 2576 wrote to memory of 1920	2576	Unicorn-54318.exe	45
PID 2576 wrote to memory of 1920	2576	Unicorn-54318.exe	45
PID 2576 wrote to memory of 1920	2576	Unicorn-54318.exe	45
PID 2576 wrote to memory of 1920	2576	Unicorn-54318.exe	45
PID 2804 wrote to memory of 1280	2804	Unicorn-45916.exe	46
PID 2804 wrote to memory of 1280	2804	Unicorn-45916.exe	46
PID 2804 wrote to memory of 1280	2804	Unicorn-45916.exe	46
PID 2804 wrote to memory of 1280	2804	Unicorn-45916.exe	46

C:\Users\Admin\AppData\Local\Temp\35dbf1cba7f399b985e24a1281b9f960N.exe
"C:\Users\Admin\AppData\Local\Temp\35dbf1cba7f399b985e24a1281b9f960N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45916.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-585.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49527.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        9⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22052.exe
        10⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        10⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        10⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        10⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19854.exe
        10⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52306.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
        9⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61570.exe
        9⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13786.exe
        8⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exe
        9⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28642.exe
        9⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        9⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        9⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
        9⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59108.exe
        8⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        8⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8007.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15389.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33418.exe
        8⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
        9⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29778.exe
        9⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        9⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        9⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        9⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33992.exe
        8⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35644.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        8⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
        8⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9540.exe
        7⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61278.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        7⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        7⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28642.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        7⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11153.exe
        6⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        6⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63660.exe
        6⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
        8⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        8⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        8⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36152.exe
        8⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        7⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19966.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        7⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
        7⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        7⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46440.exe
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9850.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59224.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        7⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        7⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        6⤵
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19350.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
        6⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45062.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        5⤵
        
        PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15703.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        8⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        8⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        8⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        7⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        7⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19485.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59836.exe
        7⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11315.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43939.exe
        6⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        7⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        7⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46217.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30464.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53916.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        6⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        6⤵
        
        PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17166.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52646.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe
        6⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        7⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        6⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
        5⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31586.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39364.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        6⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56846.exe
        6⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54847.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42096.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17563.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
      4⤵
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        5⤵
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6060.exe
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
      4⤵
      PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41329.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3836.exe
        7⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55314.exe
        7⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        7⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2204.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        6⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58976.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        7⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
        6⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48213.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35242.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
        5⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
        5⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        5⤵
        
        PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35649.exe
        6⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        7⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        6⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        6⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
        5⤵
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        6⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46475.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        5⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
        5⤵
        
        PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15860.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62126.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        6⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61999.exe
        6⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        5⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        5⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
        5⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28361.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25062.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe
      4⤵
      PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2334.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        6⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        7⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        8⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15076.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        7⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        6⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
        5⤵
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31586.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10953.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31970.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe
        5⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe
        5⤵
        
        PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        5⤵
        
        PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56479.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28361.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
      4⤵
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      4⤵
      PID:664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58711.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7996.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11753.exe
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32332.exe
      4⤵
      PID:6392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50473.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30812.exe
        5⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61432.exe
        6⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
        6⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
        5⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
      4⤵
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43424.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51778.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
      4⤵
      PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
      4⤵
      PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32960.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
      4⤵
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31586.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
      4⤵
      PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10375.exe
    3⤵
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
      4⤵
      PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
      4⤵
      PID:6976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-775.exe
    3⤵
    PID:3316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
    3⤵
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63733.exe
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
    3⤵
    PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
    3⤵
    PID:6856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29087.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
      4⤵
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65477.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28642.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        5⤵
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        5⤵
        
        PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
      4⤵
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57368.exe
        5⤵
        Executes dropped EXE
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        6⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        6⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
        5⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exe
        5⤵
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49013.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
      4⤵
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11420.exe
        5⤵
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        5⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18864.exe
      4⤵
      PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58852.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
      4⤵
      PID:6504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33320.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19854.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29460.exe
      4⤵
      PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62920.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
      4⤵
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        5⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15644.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
        6⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
      4⤵
      PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62529.exe
      4⤵
      PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
    3⤵
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
      4⤵
      PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44107.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48245.exe
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
    3⤵
    PID:3336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23450.exe
    3⤵
    PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3531.exe
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50424.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe
    3⤵
    PID:6544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8464.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        6⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        8⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
        8⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe
        8⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        6⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        6⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
        5⤵
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46217.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30464.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 200
        5⤵
        Program crash
        
        PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
      4⤵
      PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11753.exe
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
      4⤵
      PID:6460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56086.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30305.exe
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43167.exe
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22159.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3045.exe
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
      4⤵
      PID:6696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30988.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56049.exe
      4⤵
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        5⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe
        5⤵
        
        PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9342.exe
      4⤵
      PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
      4⤵
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
      4⤵
      PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
      4⤵
      PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46376.exe
    3⤵
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27076.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25062.exe
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
    3⤵
    PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
    3⤵
    PID:6412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20211.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
      4⤵
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53497.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52162.exe
        5⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2177.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
    3⤵
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
      4⤵
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3856.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
      4⤵
      PID:5308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
    3⤵
    PID:4400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
    3⤵
    PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
    3⤵
    PID:6220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
      4⤵
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        5⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1839.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46217.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30464.exe
      4⤵
      PID:6988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
    3⤵
    PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
      4⤵
      PID:6764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63187.exe
    3⤵
    PID:3128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
    3⤵
    PID:5932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
    3⤵
    PID:7044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12639.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12639.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
    3⤵
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19888.exe
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
      4⤵
      PID:6256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54847.exe
    3⤵
    PID:3344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
    3⤵
    PID:4788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
    3⤵
    PID:5484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
    3⤵
    PID:7132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
  2⤵
  PID:2116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exe
    3⤵
    PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
      4⤵
      PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
    3⤵
    PID:4320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20941.exe
    3⤵
    PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
    3⤵
    PID:6712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29045.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29045.exe
  2⤵
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
  2⤵
  PID:4080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
  2⤵
  PID:4432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
  2⤵
  PID:5688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
  2⤵
  PID:6176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe

Filesize
468KB

MD5
df75250130c84e11f0aa78a1c8cbbff9

SHA1
2593ea39a9c273be3fd87e4c9d5b501fd13709d4

SHA256
a123d61c9d03852425a266c409809e29ddc13c2564f19370c559ea6b8c06d2a0

SHA512
f92121c1050dadec661da44b4c4f09766250acaa99eeb524985489513769b1f81941f0de046a2eeef8117bd6e1557831f4e39813835bffb78e92b6600e2c2ead

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2334.exe

Filesize
468KB

MD5
e8ca7f7861eb4e691e4f51a68a17efab

SHA1
90485bd7aa89744c66417952e73d9b68790c45fc

SHA256
59b335ea1cce51923101cbbb56eea67919921dfbbdba3c0b818064e418ba0ce4

SHA512
d09bf0531a89d847385ec7f80a0a8b2a105d726f556e289d21778907e6e73bafcb3e3e91ff70d491788bd7e54a3f168826070d80667feba8d20371fb5a15df8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe

Filesize
468KB

MD5
7448326439710ea0e9977a9cd7e37af5

SHA1
4e611f0f4b608369572d1a5fabb1350b2de2993a

SHA256
dfc2aba63cf9647cf21669415af4f1276bbd6049171557b7ecd83037bbe33ad5

SHA512
41c6447e60dc61b2e9808659178623c6f5a097831a26c1c1209f7c471344d10e8e9c1e75749355098cf8476e7ac7aeb9e1efebf81c4a2cf7f7fa4b4b8fa680d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe

Filesize
468KB

MD5
eb485db4d27ae48f2b21b087e3a7cfd5

SHA1
bcb830728967e48bcb903d41856f4cb0bca300c9

SHA256
5bc6cb9ecf5e29f08a7a8dd7c0d64c965c126332d86f76eb77cd24ebc835e240

SHA512
0c05d4c6570c5c0ad9e4e7c193d4d3269eda949e1cf64d3cbcde8459ead2c1d4dec2a782ddc3d158e9a9be1bd6daf3d4ab92e0476202b2d9d8d07a198ad7ba3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe

Filesize
468KB

MD5
742d4b393e89afa927191a5c13569447

SHA1
9a03b1aa636a4b59370801dc363671d302d067da

SHA256
74b69f108a1082114a5094cf6ad01300f9e73c21e57165117e2d3d3e19d2e3de

SHA512
9d07af8161807e22489db4cd45a12922a22ad9ebde1b4fc4aae0d534c8cf0bb7c295a17f5a0df99c7b071d827e26ca840b98b01cf23115d823e8420bd77a72dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29087.exe

Filesize
468KB

MD5
a294be80b7469af0271247f12ebac83e

SHA1
4ca06212a391508a95cee1bac32d73fa50d10fe9

SHA256
ba8392b268c1f958ea031f636995ee8df1f4e83d688aed5bb24db45da4eb6f70

SHA512
a9059f850f6a63168cd920b943f8614cc8a515ab3e91e9c0c2e8ed127dec047c86dddd36514a6d37f7313fbd2a5febdea2e925e47250800b556f062adcbdaf38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe

Filesize
468KB

MD5
036c99384eaaa62311a043fbbe083964

SHA1
aa4390a51a998f64fd5c1b492f564a5d0bd9d6f8

SHA256
ac1b191c487dc7dc342c710695ca53a76dc1702c3c20d23b255ac563f3987512

SHA512
3153f283f0affe97fe1aca67810d92127ba4cf67105b40ebb01a1d8a2533f0f27dbec08c23433a4e7ae52ee53106173518e09aadbb73c4557273fd9a3ee2f375

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41329.exe

Filesize
468KB

MD5
adc72aee33c85fe93f8226ae1cbfb0df

SHA1
5630d6f140a7226ab090fdd27c380629db5ce324

SHA256
bb533a51dedf02ca8421cb9685026d038889c2692a0c8ce4c3d60db9c840ef8f

SHA512
66e9e1339d8097ac9bd3b308a5d48cbf416e250135bb963bd9ec1c5bdf60f0fbdc95b16720c17042a553ad09e0d7e5afd7b2fd549a601e3447f9f9bb74acb4a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45916.exe

Filesize
468KB

MD5
e76b2cdddb1de273aa84b5b4b063ec8b

SHA1
c6fcbca2dcf28e8414cb8ba4c73b5e1f660a6f29

SHA256
2a51dc9212d730bb18da6510fb4374007342f184d597bf055a2208a822c15e48

SHA512
2355d4afe8137c850aeb06bfc226173d710a61c47f56cad06f65888ca4370943e08e428e1676482c7512e67aefad09fd4668d9dd36f2a7e0dd451d6c34fc824b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47217.exe

Filesize
468KB

MD5
bcd15548ef470e4209064e29cb0e4a25

SHA1
9493227e16aef4456469d7aa6890c077b684dd54

SHA256
936e52282fc0de5317a91bf68ca9831e0aa124bd2f9f8d3c77e1f13bc546ab0d

SHA512
29f65d5e239bb836ff57ee95c8c22f8bf8aa9afaeda4c191f19be03648dfe252f4c88bfee9a5bc9e1c756d87b411a59a8ba245f8bd9d8567913f3e26b6ec02ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe

Filesize
468KB

MD5
572ea15dab8ac2308e44fb41cfc894e0

SHA1
419bb24fb024d6f01c128476c2d238b74fdbd87d

SHA256
f6798dfbd315b6ef7fa55068340578b2c358713f987a85605552c218154995ce

SHA512
c93cf39bbf07c299ca15e8b995638bb122506da2ba30ec722ee3a1a2243d0e5c288fcaa4d2ff26da2c6a534347df06b41d018ead185389f24ad7a0e59626eb25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52646.exe

Filesize
468KB

MD5
f4f2267f991850b796b1de7541f1dd93

SHA1
a97736151966ecfc64c8624eb9b54e2502a55338

SHA256
97e7586a87037e9c3b93f7ce536711aa967e7bd22f1ad86b1d83f49f1dd3b1d3

SHA512
863c4d10abe622cb73a787f49ef5b3c3c37d33056bd9b8a235dd2f0ae9d323c7d2d2e8a06b2d96d14918e1e18a89d024ee6011a8fb9f4fabbf07ab8ee0ae8a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe

Filesize
468KB

MD5
c542d4802ec0ffc24360cc261d15efe3

SHA1
bd9b0af78b68b8a20238d58836cec8366723a4df

SHA256
13e177ae5d230126b7800363da79fa011b79768605c643f3edcf563999b41e9e

SHA512
e476ff0cf223f553c4f5ae3e3018a2afb532f72e9938c7e3800c70161db87503d2c9440528922dede3ab1f663c3bce201eeeaff2dc298daf4147a0cc22013eab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe

Filesize
468KB

MD5
e1d095ace88705ded00bed75473d1d7f

SHA1
b5cc57d17058774a10d041ee09a3a798f8333ebc

SHA256
74fbcef7d503459f1fe2e5a6ad5ab740d5da2d17874110038656700d286bf2e4

SHA512
50a042c33292c378fa85bf16a23d6e0ee9a9a7edcfbb40630cab55cdbe68ef2965e2ab14759c373016dd3197007729e0a5367e757d67a8c6f7060760b0409a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe

Filesize
468KB

MD5
762d550874f7de8de3f056338b370471

SHA1
af48493b8221e6bf1b9a836805eec273dea71e20

SHA256
0b94149ddc1f021b6764dd835da50bc38eed7b65d684bc283b11c81558e0ea68

SHA512
3eecde7f6857e6216081292699401e62d83e95dd74e8146c94800af2b7dfa1486dd24586f94e2b9d96b64bd2763968b50b94b01119d43e07ed1e2b35e44d9819

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe

Filesize
468KB

MD5
f62881e8bd2ae61b6ebceebc302a482e

SHA1
1a3cda1c9a2deb75144cb2f384809ec4ae23ff0b

SHA256
af184ca4667d64170391fdf976f46056b05743467ee70fa3a1ecb104b0a77db3

SHA512
2dffe1e1ae5f08c12d843f1d5f5ee08bd5f9be919d0b47dea4e2b7bd2d01033c8145f33b05ba19057f2255e56240e9886b637a4f4ae34da7cdc986f49293f4a2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe

Filesize
468KB

MD5
eb8adc29cf239cf56cd180d71c1eb506

SHA1
edb5ccd05ffeba0e02197ee3a1340e18a699d8f6

SHA256
027a5ecbbde563f8b7baa81c0d533f254fe39fee1561aafc865d283efbf53930

SHA512
003ccd33aada499913b98a487803e3a6da89de25eb20b974bb40c617c69e628603d7404a9699430679e1844d741edf625f5a936459ff90c1313359acf7de359f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe

Filesize
468KB

MD5
0c8c4c157e9c597f920c40b1056d25ac

SHA1
9571a3f304b9fac0fb98f3736f9a7ecd0c23b1f4

SHA256
0dc1175d84bf7ded730d634e25a6840d4e60ffe6a0b71b6659e0311cbb7becf9

SHA512
203a5b8793819f730ede0a053a5d81f118ef429f96961e33d9897a8099b80c8c7c4eff492ff5047c511de065d6eabf4e426cfc870c22262a1be25699a16fcc70

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe

Filesize
468KB

MD5
9cf660fb8b2a4468b00a7e2e153fc87a

SHA1
62e90ee7731cec88a2829be11bfba5443a314aad

SHA256
b1d18fe7a04d370d601e3dd9c8887845bfe68e3bc962d9c909ae3326e770e376

SHA512
77a81ed352cfc3a45cca501731bf02c404b863226919db6e968fa98e96f8395d68ca3d52ace5e75139e489f3c7960ce72b61205b8af4978e266d03c8d907923a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe

Filesize
468KB

MD5
53a97fa6061bde9016b316e5e3b6f7ea

SHA1
0986a463b96de8988251e28766a447a25feeafbd

SHA256
88e1b724ffc696af9caa5303cd18d4ffb8beacaa24dee90161a5d01a6f6c7fc9

SHA512
61640c734abda5e516d1f50165ca6180dc1799c0c05d28f1ea55283be874713c9d32d8d44197b924da15d261590f287caed7803af4ea96c67de79b15813eb1a2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8464.exe

Filesize
468KB

MD5
e013440886cb688b9f807c170269dfa7

SHA1
28fc341adb0fdc33b99592a1a8eacdf031dcb17a

SHA256
253b11b6851ba25b7e913a1e0a4d1d8706fb3d5fc6d7ae329d1e53121532e7ab

SHA512
89fbda4692e14605ff76af71fe82af71dbb4c532a9b31943ece3a4f671aa6f53d07a94a30569b29b4064b6082cd1ed0a62046a663aad9765f89f0add98c47697

Download Submit