c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe
Size

468KB
MD5

05fa8b199c59e04c70f8ca4a23f65418
SHA1

596dfc5e20ce7316f57c94c94704722c2031b5e7
SHA256

c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb
SHA512

070154078e330fe0163f148e47d92944b61d5260888e9be8e7dc51bd3b1857e3578f9b6e7b327c3389d60da7dadb151564875615833e1e21d6e0c901608d22e4
SSDEEP

3072:1bACogIdj05U4AYJP0bjff8/ECYFtIponmHexVp+0Av3ApPVRGlq:1b1or8U4fPyjffh0yo0APEPVR

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4464	Unicorn-62313.exe
4872	Unicorn-10367.exe
2584	Unicorn-30233.exe
2184	Unicorn-27270.exe
1708	Unicorn-13071.exe
2284	Unicorn-32937.exe
920	Unicorn-59479.exe
3524	Unicorn-28713.exe
2684	Unicorn-41519.exe
2152	Unicorn-31401.exe
4800	Unicorn-64073.exe
1724	Unicorn-47929.exe
3948	Unicorn-41799.exe
3424	Unicorn-28063.exe
1308	Unicorn-47664.exe
2368	Unicorn-32172.exe
1468	Unicorn-24972.exe
5112	Unicorn-48700.exe
1740	Unicorn-28834.exe
1640	Unicorn-44595.exe
3304	Unicorn-18140.exe
4164	Unicorn-43805.exe
1544	Unicorn-49935.exe
4112	Unicorn-49935.exe
216	Unicorn-41005.exe
4416	Unicorn-30069.exe
1416	Unicorn-33827.exe
464	Unicorn-62483.exe
4924	Unicorn-48451.exe
2916	Unicorn-48451.exe
928	Unicorn-12601.exe
3260	Unicorn-37180.exe
5072	Unicorn-64486.exe
1396	Unicorn-21119.exe
5088	Unicorn-48346.exe
1988	Unicorn-5275.exe
5080	Unicorn-21036.exe
3280	Unicorn-64298.exe
1680	Unicorn-4626.exe
4180	Unicorn-4891.exe
4144	Unicorn-11435.exe
4644	Unicorn-10366.exe
4408	Unicorn-10366.exe
3508	Unicorn-60828.exe
1860	Unicorn-7029.exe
1200	Unicorn-7029.exe
4616	Unicorn-26895.exe
3716	Unicorn-1052.exe
4056	Unicorn-40578.exe
4832	Unicorn-34978.exe
1600	Unicorn-26246.exe
4460	Unicorn-40002.exe
3052	Unicorn-37210.exe
4952	Unicorn-60444.exe
4972	Unicorn-13355.exe
1652	Unicorn-7417.exe
5068	Unicorn-15083.exe
1072	Unicorn-31420.exe
220	Unicorn-64698.exe
3356	Unicorn-37964.exe
4488	Unicorn-63629.exe
208	Unicorn-54419.exe
1648	Unicorn-21436.exe
4472	Unicorn-33858.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
7256	5560	WerFault.exe	194
5360	7752	WerFault.exe	314

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58849.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	9088	Process not Found
Token: SeChangeNotifyPrivilege	9088	Process not Found
Token: 33	9088	Process not Found
Token: SeIncBasePriorityPrivilege	9088	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe
4464	Unicorn-62313.exe
4872	Unicorn-10367.exe
2584	Unicorn-30233.exe
2184	Unicorn-27270.exe
2284	Unicorn-32937.exe
1708	Unicorn-13071.exe
920	Unicorn-59479.exe
3524	Unicorn-28713.exe
2684	Unicorn-41519.exe
2152	Unicorn-31401.exe
1724	Unicorn-47929.exe
1308	Unicorn-47664.exe
4800	Unicorn-64073.exe
3424	Unicorn-28063.exe
3948	Unicorn-41799.exe
2368	Unicorn-32172.exe
5112	Unicorn-48700.exe
1468	Unicorn-24972.exe
1740	Unicorn-28834.exe
1640	Unicorn-44595.exe
4164	Unicorn-43805.exe
4416	Unicorn-30069.exe
1416	Unicorn-33827.exe
1544	Unicorn-49935.exe
216	Unicorn-41005.exe
4112	Unicorn-49935.exe
464	Unicorn-62483.exe
2916	Unicorn-48451.exe
4924	Unicorn-48451.exe
928	Unicorn-12601.exe
3260	Unicorn-37180.exe
5072	Unicorn-64486.exe
1396	Unicorn-21119.exe
5088	Unicorn-48346.exe
1988	Unicorn-5275.exe
5080	Unicorn-21036.exe
3280	Unicorn-64298.exe
4644	Unicorn-10366.exe
1680	Unicorn-4626.exe
4144	Unicorn-11435.exe
1200	Unicorn-7029.exe
4180	Unicorn-4891.exe
4408	Unicorn-10366.exe
1860	Unicorn-7029.exe
3508	Unicorn-60828.exe
4616	Unicorn-26895.exe
4056	Unicorn-40578.exe
3716	Unicorn-1052.exe
4508	Unicorn-26511.exe
4832	Unicorn-34978.exe
1600	Unicorn-26246.exe
4460	Unicorn-40002.exe
4952	Unicorn-60444.exe
3052	Unicorn-37210.exe
4972	Unicorn-13355.exe
1652	Unicorn-7417.exe
220	Unicorn-64698.exe
1072	Unicorn-31420.exe
5068	Unicorn-15083.exe
4488	Unicorn-63629.exe
208	Unicorn-54419.exe
3356	Unicorn-37964.exe
1648	Unicorn-21436.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 4464	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	89
PID 1644 wrote to memory of 4464	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	89
PID 1644 wrote to memory of 4464	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	89
PID 1644 wrote to memory of 4872	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	92
PID 1644 wrote to memory of 4872	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	92
PID 1644 wrote to memory of 4872	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	92
PID 4464 wrote to memory of 2584	4464	Unicorn-62313.exe	93
PID 4464 wrote to memory of 2584	4464	Unicorn-62313.exe	93
PID 4464 wrote to memory of 2584	4464	Unicorn-62313.exe	93
PID 2584 wrote to memory of 2184	2584	Unicorn-30233.exe	96
PID 2584 wrote to memory of 2184	2584	Unicorn-30233.exe	96
PID 2584 wrote to memory of 2184	2584	Unicorn-30233.exe	96
PID 4464 wrote to memory of 1708	4464	Unicorn-62313.exe	99
PID 4464 wrote to memory of 1708	4464	Unicorn-62313.exe	99
PID 4464 wrote to memory of 1708	4464	Unicorn-62313.exe	99
PID 4872 wrote to memory of 2284	4872	Unicorn-10367.exe	98
PID 4872 wrote to memory of 2284	4872	Unicorn-10367.exe	98
PID 4872 wrote to memory of 2284	4872	Unicorn-10367.exe	98
PID 1644 wrote to memory of 920	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	100
PID 1644 wrote to memory of 920	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	100
PID 1644 wrote to memory of 920	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	100
PID 2184 wrote to memory of 3524	2184	Unicorn-27270.exe	101
PID 2184 wrote to memory of 3524	2184	Unicorn-27270.exe	101
PID 2184 wrote to memory of 3524	2184	Unicorn-27270.exe	101
PID 2584 wrote to memory of 2684	2584	Unicorn-30233.exe	102
PID 2584 wrote to memory of 2684	2584	Unicorn-30233.exe	102
PID 2584 wrote to memory of 2684	2584	Unicorn-30233.exe	102
PID 1708 wrote to memory of 2152	1708	Unicorn-13071.exe	103
PID 1708 wrote to memory of 2152	1708	Unicorn-13071.exe	103
PID 1708 wrote to memory of 2152	1708	Unicorn-13071.exe	103
PID 2284 wrote to memory of 4800	2284	Unicorn-32937.exe	104
PID 2284 wrote to memory of 4800	2284	Unicorn-32937.exe	104
PID 2284 wrote to memory of 4800	2284	Unicorn-32937.exe	104
PID 920 wrote to memory of 1724	920	Unicorn-59479.exe	105
PID 920 wrote to memory of 1724	920	Unicorn-59479.exe	105
PID 920 wrote to memory of 1724	920	Unicorn-59479.exe	105
PID 4464 wrote to memory of 3948	4464	Unicorn-62313.exe	106
PID 4464 wrote to memory of 3948	4464	Unicorn-62313.exe	106
PID 4464 wrote to memory of 3948	4464	Unicorn-62313.exe	106
PID 4872 wrote to memory of 3424	4872	Unicorn-10367.exe	108
PID 4872 wrote to memory of 3424	4872	Unicorn-10367.exe	108
PID 4872 wrote to memory of 3424	4872	Unicorn-10367.exe	108
PID 1644 wrote to memory of 1308	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	107
PID 1644 wrote to memory of 1308	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	107
PID 1644 wrote to memory of 1308	1644	c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe	107
PID 2684 wrote to memory of 2368	2684	Unicorn-41519.exe	109
PID 2684 wrote to memory of 2368	2684	Unicorn-41519.exe	109
PID 2684 wrote to memory of 2368	2684	Unicorn-41519.exe	109
PID 2584 wrote to memory of 1468	2584	Unicorn-30233.exe	110
PID 2584 wrote to memory of 1468	2584	Unicorn-30233.exe	110
PID 2584 wrote to memory of 1468	2584	Unicorn-30233.exe	110
PID 2184 wrote to memory of 1740	2184	Unicorn-27270.exe	111
PID 2184 wrote to memory of 1740	2184	Unicorn-27270.exe	111
PID 2184 wrote to memory of 1740	2184	Unicorn-27270.exe	111
PID 1724 wrote to memory of 5112	1724	Unicorn-47929.exe	112
PID 1724 wrote to memory of 5112	1724	Unicorn-47929.exe	112
PID 1724 wrote to memory of 5112	1724	Unicorn-47929.exe	112
PID 920 wrote to memory of 1640	920	Unicorn-59479.exe	113
PID 920 wrote to memory of 1640	920	Unicorn-59479.exe	113
PID 920 wrote to memory of 1640	920	Unicorn-59479.exe	113
PID 4800 wrote to memory of 3304	4800	Unicorn-64073.exe	114
PID 4800 wrote to memory of 3304	4800	Unicorn-64073.exe	114
PID 4800 wrote to memory of 3304	4800	Unicorn-64073.exe	114
PID 3948 wrote to memory of 1544	3948	Unicorn-41799.exe	115

C:\Users\Admin\AppData\Local\Temp\c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe
"C:\Users\Admin\AppData\Local\Temp\c23932cb4b798b70134ca5ac3128c718030a5bd63f91be332552bbf365e3c6eb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        8⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        9⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3378.exe
        9⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        9⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        9⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
        9⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41978.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        8⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        8⤵
        
        PID:17524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        8⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        8⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        8⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        8⤵
        
        PID:17752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38661.exe
        8⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20690.exe
        7⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        7⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27436.exe
        9⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
        9⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        8⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        8⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        8⤵
        
        PID:17892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        7⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3321.exe
        7⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        7⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56063.exe
        9⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        9⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        9⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe
        9⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        8⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28473.exe
        8⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        8⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30652.exe
        8⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42716.exe
        8⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        8⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58278.exe
        8⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
        7⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50182.exe
        7⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
        7⤵
        
        PID:16536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13925.exe
        7⤵
        
        PID:18184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44435.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14267.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16450.exe
        8⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52509.exe
        8⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
        8⤵
        
        PID:18336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53494.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14633.exe
        7⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
        7⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50794.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        6⤵
        
        PID:17388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
        6⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
        8⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8590.exe
        9⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        8⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50973.exe
        8⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22982.exe
        8⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        8⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        7⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5833.exe
        7⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        7⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39215.exe
        7⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49142.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        7⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        7⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        7⤵
        
        PID:17584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
        7⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5698.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52330.exe
        6⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        7⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        7⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        7⤵
        
        PID:17528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        7⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        6⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        6⤵
        
        PID:17940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6956.exe
        5⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11125.exe
        6⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
        5⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        5⤵
        
        PID:16852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32172.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        9⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30025.exe
        9⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44867.exe
        9⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
        9⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
        8⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
        8⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        8⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10958.exe
        8⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25410.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40604.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        8⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        8⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25221.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        7⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17609.exe
        7⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57523.exe
        7⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe
        7⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        6⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8763.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        8⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        8⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        8⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7385.exe
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        7⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        7⤵
        
        PID:16564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exe
        7⤵
        
        PID:18028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        7⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8885.exe
        7⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15289.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36812.exe
        6⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28802.exe
        8⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        9⤵
        
        PID:18136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        9⤵
        
        PID:18124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        8⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        8⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
        8⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60138.exe
        8⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35094.exe
        8⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23884.exe
        8⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32681.exe
        7⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe
        7⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        7⤵
        
        PID:17624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16542.exe
        7⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58275.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63468.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54764.exe
        8⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        8⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
        8⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65459.exe
        7⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36282.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        7⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51962.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4162.exe
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        6⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        5⤵
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        7⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        7⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
        6⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26156.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        7⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        7⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32681.exe
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe
        6⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45011.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
        6⤵
        
        PID:12856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe
        6⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62710.exe
        6⤵
        
        PID:18240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42909.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
        5⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        5⤵
        
        PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        8⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        7⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        7⤵
        
        PID:17260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41173.exe
        7⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        7⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        7⤵
        
        PID:17512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        7⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        6⤵
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        6⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
        6⤵
        
        PID:16424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        6⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        7⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41394.exe
        7⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25996.exe
        7⤵
        
        PID:17776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        6⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        5⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63123.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17145.exe
        5⤵
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        5⤵
        
        PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40796.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        7⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        7⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2905.exe
        6⤵
        
        PID:12680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15826.exe
        6⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        6⤵
        
        PID:17692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64547.exe
        5⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9819.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        6⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
        6⤵
        
        PID:17716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1436.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        5⤵
        
        PID:17684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58525.exe
      4⤵
      PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        5⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37538.exe
        6⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6789.exe
        6⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        5⤵
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42147.exe
        5⤵
        
        PID:14844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        5⤵
        
        PID:17792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
      4⤵
      PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29393.exe
      4⤵
      PID:14740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
      4⤵
      PID:17592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15083.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19516.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        8⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        9⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        9⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
        9⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        8⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        8⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32665.exe
        8⤵
        
        PID:18112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        8⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        8⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        8⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        7⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        7⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54959.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        8⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        8⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        7⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        7⤵
        
        PID:17844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        6⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52486.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        6⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        6⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1918.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe
        8⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
        8⤵
        
        PID:17624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        7⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20329.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        7⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe
        7⤵
        
        PID:17912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        6⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        6⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14350.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        7⤵
        
        PID:16020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24291.exe
        6⤵
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64422.exe
        6⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58970.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64867.exe
        5⤵
        
        PID:12232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36332.exe
        5⤵
        
        PID:15688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exe
        5⤵
        
        PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60444.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64511.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        8⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        8⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        8⤵
        
        PID:17544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe
        8⤵
        
        PID:17764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24130.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        7⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        7⤵
        
        PID:18072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        7⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44262.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32681.exe
        6⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe
        6⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        6⤵
        
        PID:17600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36453.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        6⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        6⤵
        
        PID:15436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        6⤵
        
        PID:17508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        5⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
        5⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26959.exe
        5⤵
        
        PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37210.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        6⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25087.exe
        7⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        7⤵
        
        PID:17344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe
        6⤵
        
        PID:17896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        6⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        6⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        5⤵
        
        PID:10664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17145.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        5⤵
        
        PID:17656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17029.exe
      4⤵
      PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        5⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29164.exe
        6⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        5⤵
        
        PID:11520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        5⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        5⤵
        
        PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61027.exe
      4⤵
      PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
      4⤵
      PID:15252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
      4⤵
      PID:17904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17340.exe
        7⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9819.exe
        8⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        8⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
        7⤵
        
        PID:18368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
        6⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54764.exe
        7⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24268.exe
        7⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        6⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        6⤵
        
        PID:17564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26527.exe
        6⤵
        
        PID:17424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47590.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        6⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        7⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60534.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
        6⤵
        
        PID:13372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        6⤵
        
        PID:18340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        5⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        5⤵
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        5⤵
        
        PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40578.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16444.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31682.exe
        6⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
        7⤵
        
        PID:17676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        6⤵
        
        PID:18048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
        6⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        5⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47354.exe
        5⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54764.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        6⤵
        
        PID:17892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60851.exe
        5⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
        5⤵
        
        PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
        5⤵
        
        PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
        5⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20818.exe
        5⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
        5⤵
        
        PID:18428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        5⤵
        
        PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
      4⤵
      PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
      4⤵
      PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15026.exe
      4⤵
      PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
      4⤵
      PID:17996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43236.exe
      4⤵
      PID:11272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33827.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48924.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exe
        7⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        7⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25881.exe
        7⤵
        
        PID:18320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7365.exe
        7⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23209.exe
        6⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        6⤵
        
        PID:17692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26143.exe
        6⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52330.exe
        5⤵
        
        PID:15620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27765.exe
        5⤵
        
        PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54435.exe
      4⤵
      PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14350.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        5⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        5⤵
        
        PID:17416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13250.exe
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
      4⤵
      PID:13244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54835.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
      4⤵
      PID:13268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe
        5⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59068.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
        6⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe
        6⤵
        
        PID:14528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19368.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
        5⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        6⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe
        5⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe
        5⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64790.exe
        5⤵
        
        PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
      4⤵
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        5⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exe
        5⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        5⤵
        
        PID:16884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        5⤵
        
        PID:60
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
      4⤵
      PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
      4⤵
      PID:13208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
    3⤵
    PID:5560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 720
      4⤵
      Program crash
      PID:7256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
    3⤵
    PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
      4⤵
      PID:10056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
      4⤵
      PID:13932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
      4⤵
      PID:17520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
    3⤵
    PID:13608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63542.exe
    3⤵
    PID:17324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37230.exe
    3⤵
    PID:6340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10367.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10367.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18140.exe
        5⤵
        Executes dropped EXE
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16444.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        8⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        9⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        9⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49702.exe
        9⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54253.exe
        9⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        8⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        8⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
        8⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
        8⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe
        8⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        8⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        7⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41130.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47590.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
        8⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47350.exe
        8⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        7⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        7⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        6⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40002.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16444.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        7⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        7⤵
        
        PID:17636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
        7⤵
        
        PID:17712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45414.exe
        6⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55635.exe
        7⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        7⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55491.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
        6⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
        7⤵
        
        PID:16416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        7⤵
        
        PID:18004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61779.exe
        6⤵
        
        PID:17424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        6⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        5⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22910.exe
        5⤵
        
        PID:17116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18882.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57999.exe
        7⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
        7⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7605.exe
        7⤵
        
        PID:18280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        7⤵
        
        PID:18280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
        6⤵
        
        PID:12076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        6⤵
        
        PID:17004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        6⤵
        
        PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
        6⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        6⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exe
        6⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        6⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12348.exe
        6⤵
        
        PID:18352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
        5⤵
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        5⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37092.exe
        5⤵
        
        PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        7⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        7⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25221.exe
        7⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        6⤵
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        6⤵
        
        PID:18008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        6⤵
        
        PID:17564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65398.exe
        5⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16092.exe
        6⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34962.exe
        5⤵
        
        PID:18404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3673.exe
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        5⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        5⤵
        
        PID:15280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24268.exe
        5⤵
        
        PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43970.exe
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
      4⤵
      PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
      4⤵
      PID:16032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41470.exe
      4⤵
      PID:17540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11435.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        8⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        8⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        8⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        7⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        7⤵
        
        PID:17932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        7⤵
        
        PID:18068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        7⤵
        
        PID:17724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        6⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
        7⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
        7⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40938.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        6⤵
        
        PID:12936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        6⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        5⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36578.exe
        5⤵
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65198.exe
        5⤵
        
        PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20041.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
        5⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48426.exe
        6⤵
        
        PID:17952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
        5⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54764.exe
        6⤵
        
        PID:11172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14565.exe
        6⤵
        
        PID:13712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58093.exe
        6⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        5⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        5⤵
        
        PID:14212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46506.exe
        5⤵
        
        PID:18084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2933.exe
      4⤵
      PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1790.exe
        5⤵
        
        PID:17728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32569.exe
      4⤵
      PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3874.exe
      4⤵
      PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
      4⤵
      PID:17668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10213.exe
      4⤵
      PID:1952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21036.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exe
        5⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe
        6⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57900.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        7⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        7⤵
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        6⤵
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        6⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        6⤵
        
        PID:17700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48453.exe
        6⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        6⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
        6⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
        6⤵
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        5⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27765.exe
        5⤵
        
        PID:17736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
      4⤵
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        5⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        6⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        6⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        5⤵
        
        PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28473.exe
        5⤵
        
        PID:12988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        5⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30652.exe
        5⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        5⤵
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exe
      4⤵
      PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        5⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        5⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        5⤵
        
        PID:17028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2098.exe
      4⤵
      PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64874.exe
      4⤵
      PID:12252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
      4⤵
      PID:16068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
      4⤵
      PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
        5⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48284.exe
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
        6⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20412.exe
        6⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exe
        5⤵
        
        PID:12260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
        5⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        5⤵
        
        PID:17384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1202.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        5⤵
        
        PID:11608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        5⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
        5⤵
        
        PID:17552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
      4⤵
      PID:8424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
      4⤵
      PID:12888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
      4⤵
      PID:15804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13925.exe
      4⤵
      PID:18220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
      4⤵
      PID:1552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-393.exe
    3⤵
    PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1003.exe
        5⤵
        
        PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62365.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe
        5⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        5⤵
        
        PID:17572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
        5⤵
        
        PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33218.exe
      4⤵
      PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        5⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        5⤵
        
        PID:17504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        5⤵
        
        PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48099.exe
      4⤵
      PID:14304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
      4⤵
      PID:17328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52486.exe
    3⤵
    PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30709.exe
      4⤵
      PID:14612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
      4⤵
      PID:4168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62588.exe
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14289.exe
    3⤵
    PID:13212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23898.exe
    3⤵
    PID:17284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39550.exe
    3⤵
    PID:6968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59479.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59479.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4891.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33551.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        8⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        8⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        8⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        7⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
        7⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45987.exe
        6⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21941.exe
        6⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
        6⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        7⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        7⤵
        
        PID:17536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
        7⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30025.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        6⤵
        
        PID:17272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22149.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        5⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        5⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20409.exe
        5⤵
        
        PID:13968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        5⤵
        
        PID:18096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        5⤵
        
        PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        5⤵
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
        7⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        7⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
        7⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        6⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        6⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
        5⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
        6⤵
        
        PID:16596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
        6⤵
        
        PID:18348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49165.exe
        6⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6482.exe
        5⤵
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        5⤵
        
        PID:17000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        5⤵
        
        PID:17688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
      4⤵
      PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exe
        6⤵
        
        PID:13540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        6⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exe
        6⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        5⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        5⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        5⤵
        
        PID:18144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
        5⤵
        
        PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
      4⤵
      PID:13656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
      4⤵
      PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16900.exe
      4⤵
      PID:18216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44595.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64525.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exe
        7⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        7⤵
        
        PID:16948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exe
        7⤵
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        6⤵
        
        PID:13204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        6⤵
        
        PID:17300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47990.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46506.exe
        6⤵
        
        PID:18060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        6⤵
        
        PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        5⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3769.exe
        5⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        5⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21140.exe
        5⤵
        
        PID:17544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35970.exe
      4⤵
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8763.exe
        5⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        6⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        6⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
        5⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        5⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        5⤵
        
        PID:17672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
      4⤵
      PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        5⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        5⤵
        
        PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
      4⤵
      PID:8816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
      4⤵
      PID:12368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54243.exe
      4⤵
      PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
      4⤵
      PID:17836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
      4⤵
      PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58924.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        6⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        6⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe
        6⤵
        
        PID:18012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        5⤵
        
        PID:15960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
      4⤵
      PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
        5⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        5⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe
        5⤵
        
        PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
      4⤵
      PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
      4⤵
      PID:12940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
      4⤵
      PID:16208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64470.exe
      4⤵
      PID:18292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
      4⤵
      PID:18408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5410.exe
    3⤵
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe
      4⤵
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58367.exe
        5⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        6⤵
        
        PID:15320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65213.exe
        6⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        5⤵
        
        PID:10840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        5⤵
        
        PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
      4⤵
      PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
      4⤵
      PID:11488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
      4⤵
      PID:14988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
      4⤵
      PID:7620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
    3⤵
    PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
      4⤵
      PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
      4⤵
      PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
      4⤵
      PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
      4⤵
      PID:4184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11298.exe
    3⤵
    PID:8860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
    3⤵
    PID:12012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28506.exe
    3⤵
    PID:16876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25237.exe
    3⤵
    PID:2132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47664.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47664.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        6⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7752 -s 648
        7⤵
        Program crash
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15106.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34444.exe
        6⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        6⤵
        
        PID:18400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe
        5⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        5⤵
        
        PID:15504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
      4⤵
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
        5⤵
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53939.exe
        5⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        5⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        5⤵
        
        PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
      4⤵
      PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12025.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
      4⤵
      PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
      4⤵
      PID:5900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32229.exe
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38492.exe
        5⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        5⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        5⤵
        
        PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
      4⤵
      PID:12548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
      4⤵
      PID:16256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58851.exe
    3⤵
    PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
      4⤵
      PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        5⤵
        
        PID:12828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        5⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-261.exe
        5⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe
      4⤵
      PID:9612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44445.exe
      4⤵
      PID:14648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
      4⤵
      PID:7032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
    3⤵
    PID:8416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
    3⤵
    PID:11856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
    3⤵
    PID:15524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54877.exe
    3⤵
    PID:5344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe
        6⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        6⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        5⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        6⤵
        
        PID:15660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        6⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        5⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13906.exe
        5⤵
        
        PID:16024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52710.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58093.exe
        5⤵
        
        PID:17696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exe
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
      4⤵
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
      4⤵
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
      4⤵
      PID:3332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45203.exe
    3⤵
    PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20137.exe
        5⤵
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        5⤵
        
        PID:17644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
        5⤵
        
        PID:17504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
      4⤵
      PID:8220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
      4⤵
      PID:14128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
      4⤵
      PID:17924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
      4⤵
      PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
    3⤵
    PID:5844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
    3⤵
    PID:10644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
    3⤵
    PID:14512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
    3⤵
    PID:18360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
    3⤵
    PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe
      4⤵
      PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        5⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35890.exe
        5⤵
        
        PID:13680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        5⤵
        
        PID:16424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        5⤵
        
        PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
      4⤵
      PID:8304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
      4⤵
      PID:14120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
      4⤵
      PID:17916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
      4⤵
      PID:2392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
    3⤵
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
      4⤵
      PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
      4⤵
      PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9660.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
    3⤵
    PID:9824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
    3⤵
    PID:14428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
    3⤵
    PID:6820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe
  2⤵
  PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
    3⤵
    PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
      4⤵
      PID:12476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26101.exe
      4⤵
      PID:15944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25612.exe
      4⤵
      PID:5516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3378.exe
    3⤵
    PID:9772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-617.exe
    3⤵
    PID:13816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
    3⤵
    PID:2908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
    3⤵
    PID:5288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33537.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33537.exe
  2⤵
  PID:8056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
  2⤵
  PID:10928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exe
  2⤵
  PID:14876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exe
  2⤵
  PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5560 -ip 5560
1⤵
PID:6728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 7752 -ip 7752
1⤵
PID:5252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10367.exe

Filesize
468KB

MD5
6db18d8b33cebd05bc8c0fd51a924b32

SHA1
112bb28826717f162f2d31f7a6d1a9189fc2fe0e

SHA256
e1d1b3d0d9c36d0680e392bad90137580391b963e5579113d790c834ae072efc

SHA512
fb669417de75d6ab5ee17831961c22acdbd99e3738bd7851e58c7407a9341779a9a2cb0f3a5f87f81ae610e8bf5281c53f8642d68c1cd6b6815b310dac8547d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe

Filesize
468KB

MD5
a5a69d95592a2287673e384606a4dbaa

SHA1
b4358eca1f26690a9462ed093dd580443ce9b89d

SHA256
72c36d4c0ec3d400e1e505755df44da90c0322f10767dade4247dafc0d4c3744

SHA512
64fed749be647ea19ca88bcdb2eea76fac537c6684b265cf2012b177afe712d037ddbc414631bd23f014e58934ac1afc90179a77e255b3d9659ca79984f28dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe

Filesize
468KB

MD5
aa8d67923ae06d7eb87b2a5e2e81280c

SHA1
7a03cd4636c4d0f66e24559571587ad639918572

SHA256
bbf44775f2cd7d26a27ab8df3d610840f9fbb3290f67f0b40a95863f9fcc33f1

SHA512
91338946a38cc7f91b91d11cfec79a71d11dffcfc6671a422c4da375865b671d5c5208154bdd4770d021002e66cf5ef629e7d79d2afea607530e6c6dc851fbc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18140.exe

Filesize
468KB

MD5
4782f43fdd2a75ae43f15ce532573ff6

SHA1
a5219dd413e7dee7632bf60a23e18f35c5cb5349

SHA256
f024821e37c1a92a84fc11f12d6edc407c5bcdaf786a33173a8283ec16741653

SHA512
317dc9566e1b083247d0ff775423750b73337fee39e1e62311f962ab6b71d6b123ca488a76588d3c87ad2895b3e50ee5c17f1aa0cf53e31d989d7f9315f73e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe

Filesize
468KB

MD5
37300681d5d69d1db39fbe66a0be9903

SHA1
95210fee5e604fecbb54c4987d160fba961309e5

SHA256
0eac7c7e328ed536810d75c63af6c9320fac93c45587baef894e50b1085b919f

SHA512
94f94a07a8eb11ca4a2eeb087f861b9deebb1510999896c1f590896394ebca1cd98764da2853923fb82c371e285bc6acf44e1266edb62a6dc1e1537df5c9f6c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe

Filesize
468KB

MD5
12ed02502fc046db4d8c94df81c47f7d

SHA1
a1c051a2a1fc527870b7561a42b9e11275b1a6f0

SHA256
26f30fb17cc6df0286bd294ed0199084a441ec897196ef68b198c7f5be417632

SHA512
62b658ca65582f3c78c121dca712ec7bd6ecf0cc7d43003dcd115c85fd7d5810d8ff76a77d32916450ff6fe45b713af91bfb94d08edd71b2f2b4624aed330d78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe

Filesize
468KB

MD5
e6dd0ec7cca4c7d9586e401bed42e5ea

SHA1
23694a0adbe670cf09c9edf0af7e7975e8931955

SHA256
1767b5713928c1e12997424a0db294f21ebe87a0dcc72b2eea9a4599f0525c8d

SHA512
e5a5ae9f48ab78463ab7a56c60fba3a239dcd3a55036c72c16c0544a593675466cedf5a945ca60ac3da335a0460a4e4bd0bab68be73e720a3289a4e4df03014a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe

Filesize
468KB

MD5
360c142ad9de56bf14dd92a0222f0d28

SHA1
704fcf060e48ccca149174e7670b38b66d4e30ee

SHA256
b25f94cefa278c4562b2e3ffd728cc057f57cd6d868fc64b76b46cda836abff8

SHA512
9adfec57f9eee4b3fa86998102a184158c52a5c6f5666633cafad9e6b8ca6319a388e3ccef33434f1dfe2f38e784fc08eb677156a897cb8b310a4add1e72c50c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe

Filesize
468KB

MD5
b197c93a58908965c911a3038449c79f

SHA1
e4cf58d4bb215344665afb66e8ff8685f238ac8e

SHA256
291e3b0c007a9ec77d79c3397e4aaddacaaea19e22a754fd8860a57d68a7b2a8

SHA512
15fa4284a09348564e19184b0cb975a0f90ba1d5ac7781b905cd9210bdc3ff2b49bdddef2e2bea4c251e8887e647b72ab24fd2bf5d1f1e28f812ac84a94dfa73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe

Filesize
468KB

MD5
a5759b2b1530a266090c19a1739b30e9

SHA1
92bf4248554b581090bac75a475fbecc5bd1b3b2

SHA256
5e0ad0579fd12c06b3728d7498d64b4823fbe3f71545f3e26b2fbe0594ee5555

SHA512
14715d2a03017c08468ca3e72db4d06e28943229db31d49e6b956e3edbc133b67e7aeb093bb013922788f720244e39f57562aba9950af62012fbdd6b3ba0eaa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe

Filesize
468KB

MD5
08ba36b9559662bf4f4dc38ca8b2be96

SHA1
4c19c4690e11171d887c57aad112be4affcc9c96

SHA256
b8a4f38f2f1bc645bb91ebb28e86ae2e70859b199b4e8d2871c8efbcc0a77dae

SHA512
a231ae30ca0e85366fc66890010c39967ccdaada10b05c6b7ac08011cbfb30e38f7dad82b89f19b4f374b3fa6f7ce33107c1442017c98b36bb91b8028375e76c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe

Filesize
468KB

MD5
21af4b958d0b38578afe3959e3b50bc5

SHA1
ee885085699c077076d294d9db580fbb3c85a85e

SHA256
549a9f3b6e13198c4be0d097cb3757ecc320f43876fe2376ac9f049edacaee83

SHA512
8f8ae213e2f252939dec03bdf654854c6fe1fbf11a3cd37a08f3f978b0fa60592b781b8377ee19fb8cf1d8c6077865dac8e1fb1eda6d01666d932a77edeaab72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32172.exe

Filesize
468KB

MD5
1380e8a9a4b863892a6538016360c0ec

SHA1
b2859f9b4a4b6d3802bfa523136c97e9ee668796

SHA256
eab717aac0994d06b9bff314a50ce85f2b3a2d9e955dabeefb430432168e99f5

SHA512
3f5ad5fb2626cdbec89952de4afdde9f58d98b34c5b655f2a7339ce3955a66c97c44d60cc4b591a38cad8684e415c402398b0e0815ff5df364e767c7eed2ed79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe

Filesize
468KB

MD5
31df5a70d239676f531fe672e79027c4

SHA1
5364b9c5c986f46319238447ee9a727aa15fc133

SHA256
1f90d61cd1b755458c690f9d2a0adad2496e2f09052ad5fc6af6f8ee1130b16c

SHA512
376b3905cf11aeeda118781d4e60eb047383fc674446383de342c59962cd1f812865c699cc4b87d34d7ec2c3b8c85c0effaa572124ec45ca0d4cd6ece2aae5d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33827.exe

Filesize
468KB

MD5
dc909ec8ba793b8b361e205b29e89e16

SHA1
783b7fa1b5ffde27d2cd0ed913ba1acbb8826459

SHA256
f19afefb6043ff95f0aea535926d3947d4ef26a0f398abfb95cae11fe871df67

SHA512
9041a4baa0a2d0a3206c64004587bf526cdb8ff64cadc1198d3a8ea4a5f79b16e6805d7ed08e66dd2e0a5f004940db644c3292ea76ce3ad384c798d6f08c00d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe

Filesize
468KB

MD5
522826c99ae4d83e50fe5d0e73b8101c

SHA1
993da4caeb5beb17883c61fe39bf0d9b08d38b92

SHA256
28076cacdfb744efe130e0208569bb91c73e68c12ab68fc5f1e01c12e57a5355

SHA512
1aa72022d40df8ca3ca80b5a78a7ea57b3d140559017f38e968e7d61e0f4b432f94be7fab7525453f4ef45e57d4dbafbecb64591e784dc412c98d502a7044502

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe

Filesize
468KB

MD5
acabe84d7c333aba8773444df04513b6

SHA1
ac1d240317b903c286f87983b0d396ad9f63f251

SHA256
b8e35dbc073d42c847a5f560d05de8ee637740ea41f90e3ba061868d3a600716

SHA512
71d9171b16170e5f699fcc56745b91b9a71727799b57ea713302ac07c219079441b2cfcc4491b14d587846a207e1581f25b4243dddcf2aa4c6f138b370ce4a41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe

Filesize
468KB

MD5
f72be3973a350142b8ddebee7c061197

SHA1
5a3d7bdcfc8e4efd158efe27372be8490ef3a7ba

SHA256
98c71a8bce969e02b24d1b5423e52a1303644fa20a1b6d9b45bc9387a2dd29cf

SHA512
af5fde320d6c975bfdabcfa0282c7d69c083677331e897e9632c96b90836cb1dd3e4f6d678c389484e30920b626c8cfa5006eedc63dd50ab7343d275ed9806cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe

Filesize
468KB

MD5
bf084ba8c31b4a64997c048ac4f3546d

SHA1
50919a746738ae29e649035189bcfbc57caba8ab

SHA256
b216c4357d30251bf3804bc367fef34222dcd634be94aabfc2cc8064d6164073

SHA512
4cb8f710b6dbdef304e01123ba84fc8f332a935c79baea2eb6feb118625a9e497b29ac67d64725579279121713b584e5d2b8e00373ccc64c43a725530af0a9de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe

Filesize
468KB

MD5
8ec37a13184c6f76400cdfbd65f95267

SHA1
8debd9abaf96518b4cf29a838a95d8476c1807fb

SHA256
fde7cee9a4d1e7a3fe158f42684ff41e7d6777554d3ca98cae8991872a48a6f5

SHA512
82eb33b6827573ef40f4f8a65a7d294c19406775bad769bd6a08e36d977f30e8ee6018fa652ba771f6b5cc96b0d8f3322f60f78ec82b373f30a3ea5ed5192a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44595.exe

Filesize
468KB

MD5
22be2a2ef40e748dd12cb901fd0c8689

SHA1
a380e80aeb97199281e854101239b58d28d7ae35

SHA256
79440d61242e62a70ff4e7162c826bcd8698580d4e1cb061fe01f282186d4ae7

SHA512
ce02dec76eef5b4dc8842b7e44d629de16e0e25f9c196c5ab437ce87a82bd7d714c6c6395e178d73513c61d5683cf583a26f3b0395f581187d280d338e9da230

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47664.exe

Filesize
468KB

MD5
92127f6631b3e8bcc98ad188d987dfe7

SHA1
2884664fe8275b485a7904cc8aeb0a867da52995

SHA256
99af0b95a02e87376e998bffeb78369658c75472598eba1c573ee8e8b300519c

SHA512
2d4c0f1fdd7107452a0be3c7cd108e0ceed7837a34a2389de032334ecd3e3e81552d7f8619f832ef5e3325c67bbee11538e5a5e263e2c5d01ba4dee1c4c2bb59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exe

Filesize
468KB

MD5
edbc584796f117c877f9510fe65ed014

SHA1
9d35fcffec419868d1f76fb3802ba8b5f4eef590

SHA256
7876c8ef26e8eaa225138821ba80359232262a3160531fa46dd9d62708145839

SHA512
9108f16c28d385c1f96852ebea616f606f5452d096bf241b8905bed5f1d6b7def7e05317a538e0779528f3c486f6e1fcb156f54763d2796d538cca3a0df89d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe

Filesize
468KB

MD5
05f48e3ffe285bd0d7030346a1583554

SHA1
6bd14b54ab70d837af92c29338f0c3b17ba5c933

SHA256
8db175f511b5104eb9fbfd20bc5e2b6b00eca44e1ad7306a6c9a6ccec7d6d9be

SHA512
cea290c4d4592f1894b880b5bdb9320b337481d5e0f91fef57884261aa9a4393edd9f6bd4590f7d9f744d55f6a91071ef9421fa26d16b69441006e5cce401193

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe

Filesize
468KB

MD5
42caec23489a641c8c4276eacef64d5d

SHA1
ea4f77d9b672971ddb778f28f31c4b21fb2ce25d

SHA256
e3056c342f37ca1cd5952f161d52149192970ab1a20f00f88dcd2e797c4e9a45

SHA512
6db5764bb3e5e4f049dd81b7ccd67885f2167d1d0cf3523bc382897e672b8f3d05bc8ad2264e505c3cea95dc243e09f25014ed2b3d8cb7c90ef7d35748f7b123

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe

Filesize
468KB

MD5
cf871d90b2bfae7b0f0314ab5231b65e

SHA1
1a3977b98bab3d10f64432e4b8ae267c203e55ae

SHA256
a3b4d70bcf0a378895db2f1d4d54bfb192d8851bd791c7b2a3e013402e3f736f

SHA512
4018e7a2f163e3baeca2dcce1df1a4b3988cd61b75f9cb44a38a27f57aecf6bf72177db11c578dee8f8e9982cf3204457c5c4847db4fab33e2d6c6a0c8d02bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55491.exe

Filesize
468KB

MD5
93ea6716ee3779962047c2cb10767d8f

SHA1
e8a9604283e5f43e688fa5e9405556f1ee2a37c6

SHA256
ef5554584c518cf69d3158054c15ed256d3f5e72c33bff7f5b35e0014ee8e28d

SHA512
71e285129fad138065e720e7c5ffebbc271fc46fca54c51e64c53b267f281f2d31ca2ed01a5520655c31a6a2a3279e25c3a7057573db0f0c0bd8856121f807c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59479.exe

Filesize
468KB

MD5
8bd519660048feebf2b809e5fd2cb10a

SHA1
1b691aea761866cdfd37da8ae6c2a1d9123b22cd

SHA256
8045487036372fc8d73f6e82c1564e9643fb2968ff311018c6b33578f111a5e1

SHA512
5944ff564d5bc083e9f8f93f2c29a7d2db3943e72e0d6f0623683aab8c9d01221db9e7ab0f2b1be3af496997dfc5fb402ddafe536834aab723e766f093ae2348

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe

Filesize
468KB

MD5
4d648b0375227e7bcca21d25a8d0afc7

SHA1
bfb483a0ee89d81161abded2bc6b8fa737734658

SHA256
b6616816719928e70862ea9b94bc2d1d05596230a797320e614ffdfd6afbb751

SHA512
ce8614e6ac6e2a1ab380e4b22437b5554369d385933e1264a73010ff82d222e91853c955dcfeeb6e204a4df18f4a338d943107d5399dfce0ded07fa5cd2e5698

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe

Filesize
468KB

MD5
b1dc9d761d1375a66d78ed98461c0186

SHA1
d4c8611e5be000d29246b78d57ebc2d361b99350

SHA256
54f103c556011b9623ec122492605498e2a28474ed2260e1d1fb402abbb9323e

SHA512
0ce5af4cac6615ce23c86d7d2d44d0e7a75f15fbd3cac6430bb97e034be51673dfa89477a57dd6c46319be1421bcfcc86dde826a190e215042f38ae75972e691

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe

Filesize
468KB

MD5
87e47a0c6666f4c7499d271a4b6870e8

SHA1
b082b495eab9d8425066e85a5d37e7672774abb8

SHA256
9d33f0d65e8ae2b347a5c1ecc82fb827cf438a1b2e4c78740e6a4d532a1eb47f

SHA512
3eef1641b594cc6174f1a6cbd8f0c5d30a62fec2b55108557ddf4503e0784980badd595463509e103926225292dd7dcb5db5e51b25fd0e99eb2718c4af61fd97

Download Submit
memory/1468-2624-0x0000000074D70000-0x0000000074E0B000-memory.dmp

Filesize
620KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads